How to visualize difference between two fields


(Pola) #1

Hi,

I have 'setcount' and 'clearedcount' number fields which i added in logstash when it finds "set" in message field setcount is set to 1 and if it finds "clear" in message filed it sets clearedcount to 1.

each event will have either setcount or clearedcount.

I wanted to visualize something like setcount - clearedcount per host.

How can i acheive this in visualization.


(Bhavya R M) #2

Hi Pola,

You can use a scripted field here. Here is where you will add it:

Once you do you can use any basic chart to do your aggregation on it.

Thanks,
Bhavya


(Pola) #3

Thanks bhavyarm! I ended up in doing the same thing and it worked. Thanks for sharing.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.