Ingest pipeline script field math

Elastic Stack Kibana
1

Hello,

I'm trying to create a ingest processor pipeline in kibana and could use some help. I'm trying to divide 2 values by each other which is the problem. Value 1 is an integer and Value 2 is a string. I'd like to get the cardinality/unique count of recurring strings before doing the division:

ctx.average_consumption = ctx.integer / ctx.unique_count_string

Any thoughts on how to accomplish this in Kibana?

2

Just bumping this.

3

Just bumping this

4

Hi @gentle_ghost

I am a bit unclear what you are trying to accomplish... an ingest pipeline is run on a "Per Document" basis so it will not understand / have access to aggregations across the index.. so unless that /unique count of recurring strings is part of the document that is currently being ingested you will need to take a different approach. Do you already have that field in the document?

5

Unfortunately, I'm just not sure how to accomplish this. The enhanced data table plugin would work for a computed column but is unavailable for the current version I'm on.

Essentially I'm looking for a column that is Column A/Column B where Column A = Sum Aggregation on number field and Column B = Unique Count on string field.

I'm uncertain how to populate a column or field that would contain that data.

6

If you can provide sample data and the end result I think we can work through how to do it. Or at least determine if it's possible.

7

How would you like to have this sample data presented?

I have the field Total_Time_In which is the count of the duration in seconds each individual was in the room for. I need to sum this.

I have a field unique_person which concatenates the string fields Name + Role. Fore example Bob + HR, Bob + Accounting, Sheila + Engineer. This is where I need the unique count.

What I'm trying to do is get the average time each unique individual spent in the room.

average_time_spent = total_time_in / unique_person

An ingest pipeline with a script seems like where I'd want to go with this. However I can't figure out how to turn the string into a unique field for doing aggregations with.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.