How to graph only the stack total?

Elastic Stack Kibana
1

I've built a time-series line chart.

It has just one metric: the latest value of one of the term "item.value" (top hit, item.value, sort on @timestamp, max)

The primary bucket is a date histogram.

It has a second bucket ("split series") which separates the values by a term ("item name"). This produces about 10 lines on my chart, which I display stacked.

The top line is the only one I care about: The total value of all my items over time.

How can I graph just that total of the stack without showing the value of each item underneath it?

2

Hello David,

It sounds like you want the cumulative sum aggregation for a running total. Does that sound right?

Also, here's a related issue in case it helps.

Regards,
Aaron

3

Aaron:

Firstly, thank you so much for taking the time to look at my question and make a suggestion! I really appreciate it.

I don't think the cumulative sum aggregation is what I'm looking for. It appears to sum up all the values for a specific metric over time, giving me a running total of that metric.

What I am looking for, instead, is the most recent sum of each split value in my "split series bucket" (I am splitting on a name, and my metric is the last value for that name) .

For example: If my incoming data is

 { stock_portfolio: [
    { "name": "Apple",   "value": 600 },
    { "name": "Amazon",  "value": 300 },
    { "name": "Facebook","value": 400 },
    { "name": "Netflix", "value": 100 }
 ]}

I could graph the total portfolio value over time by creating a time-series graph with the latest value of stock_portfolio.price, with a series split on stock_portfolio.name, and stack the output. The top line represents what I want to see, but I don't want to see the underlying individual stock prices, only a line for the total portfolio value.

In short, I am trying to graph the top line in a stacked chart, where the sub-elements are the result of a "split-series on term". Is there a way to calculate the sum of the split-and-stack?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.