How to use timelion to get a ratio

Elastic Stack Kibana
1

Hello,

I want to write a script in Timelion to get a ratio.
The idea is :
count(field_name) is not null divided by count(field_name)

  1. The index name: call
  2. The field name I want to count : drop_rate
  3. The value of drop_rate are 1,2,5,NULL.

My script:
.es(index='call',timefield=ts, q='exists:drop_rate').divide(.es(index='call',timefield=ts)).multiply(100)

It can run, but I think the result is not correct, I think I made something wrong in the query part, please help me, thanks.

John

2

I believe it should be _exists_:drop_rate

1 Like
3

Actually, upon further investigation, it doesn't appear that worked.

I will come back to this tomorrow.

Here is my sample data:

DELETE /discuss-105457

PUT /discuss-105457
{
  "mappings": {
    "doc": {
      "properties": {
        "drop_rate": {
          "type": "integer"
        },
        "@timestamp": {
          "type": "date"
        }
      }
    }
  }
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T01:00:00+00:00",
  "drop_rate": null
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T01:00:00+00:00",
  "drop_rate": null
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T02:00:00+00:00",
  "drop_rate": 1
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T03:00:00+00:00",
  "drop_rate": 1
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T03:00:00+00:00",
  "drop_rate": null
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T03:00:00+00:00",
  "drop_rate": null
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T04:00:00+00:00",
  "drop_rate": 2
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T04:00:00+00:00",
  "drop_rate": null
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T05:00:00+00:00",
  "drop_rate": 1
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T06:00:00+00:00",
  "drop_rate": 5
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T07:00:00+00:00",
  "drop_rate": 1
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T08:00:00+00:00",
  "drop_rate": 2
}

POST /discuss-105457/doc
{
  "@timestamp": "2017-10-26T09:00:00+00:00",
  "drop_rate": 1
}

.es(index='discuss-105457', timefield=@timestamp).label('all').lines(fill=1,width=0.5).color(gray), .es(index='discuss-105457', timefield=@timestamp, q='_exists_:drop_rate').label('dropped')

05
Screenshot 2017-10-26 20.31.05.png687×550 17.7 KB

4

@tylersmalley Thanks, I figure it out, here is my script.

(.es(index='call',timefield=ts, q='exists:drop_rate).divide(.es(index='call',timefield=ts))).multiply(100).yaxis(label="Drop Percentage").lines(width=3, fill=3, steps=T).color(green)

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.