cva
(Vycheslav)
December 28, 2021, 6:47am
1
Hello! need help with visualizing this query in kibana:
{
"size": 0,
"aggs": {
"orders_per_day": {
"terms": {
"script": {
"lang": "painless",
"source": "doc['ctime'].value.dayOfWeek"
}
},
"aggs": {
"avg_per_hour": {
"bucket_script": {
"buckets_path": {
"count": "_count"
},
"script": "params.count / 24"
}
}
}
}
}
}
my log
{
"_index" : "test",
"_type" : "_doc",
"_id" : "09-20-00-246697_test.log",
"_version" : 8,
"_score" : null,
"_source" : {
"hash" : {
"sha1" : "ded3628a07efdce5cb972d24020852bb16e35a48"
},
"filename" : "09-20-00-246697_test.log",
"ctime" : "2021-12-28T06:20:00.246Z",
"@version" : "1",
"tags" : [
"GT",
"beats_input_raw_event"
]
lukeelmers
(Luke Elmers)
December 29, 2021, 6:54pm
2
Hi there -- Bucket script aggregations are only available in Kibana when using TSVB visualizations. These two forum posts give some nice examples of how to use it, hopefully it helps point you in the right direction:
Hi Henrique, I think solving your problem will be a two-step process.
You'll need to create a per-document field for cost * volume, e.g. a field called volumeCost. You could create this field two ways, either by reindexing your data and adding the field with a Painless script, or by creating a scripted field that calculates this value on the fly. The first option is a little more performant when querying your data but the second option might be easier.
I think you can create a Timeseries v…
I have data in JSON Lines format that contains statistics about the tasks performed by a system over an interval of time. (The specific definition of "task" here is not important.)
Each line of JSON Lines contains, among other fields:
A time stamp representing the start of the time interval
The total number of tasks in that interval
The total response time of those tasks
For example, here is a snippet of one of the lines:
{
"Start Interval": "2019-08-31T15:45:00.000Z",
"#Tasks": 6,
…
system
(system)
Closed
January 26, 2022, 6:54pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.