Is it possible to dynamically aggregate time?

Elastic Stack Kibana
1

Hi community,

I'm pretty new to ELK and still learning by doing to see if it fits my need.

First of all a bit of background:
I have a program that will launch a bunch of processes and at the end, I want to generate a report with the execution of my program, the number of successfull/failed processes etc.

I plan to create some documents in Elastic that will have th following type
ID: int
EXEC_DATE: datetime (the date and time the step was launched)
STEP_NAME: string (name of the process executed)
EXEC_STATUS: string (S for success / F for failure)
EXEC_DURATION: datetime with format 'HH:mm:ss' (this represents how long the process ran)
EXEC_DURATION_EPOCH: long (translation of the duration in epoch in case I need it)

Let's imagine I have the following entries
1 | 2016/02/15 11:00:00 | step_1 | S | 00:15:00 |
2 | 2016/02/15 11:15:00 | step_2 | F | 00:35:00 |
3 | 2016/02/15 11:50:00 | step_3 | S | 01:10:00 |
4 | 2016/02/15 13:50:00 | step_4 | S | 00:05:00 | ...

based on that input I'd like a line plot with:
1st value = 00:15:00
2nd value=00:50:00 (duration of 1 + duration of 2)
3rd value=02:00:00 (duration of 1 + duration of 2 + duration of 3)
4th value=02:05:00 (duration of 1 + duration of 2 + duration of 3 + duration of 4)

and on the other hand, I'd like a histogram bar with a size of 4 (4 steps) that cumulates:
3 green units because I have 3 successfull step and 1 red unit because I have 1 failed steps.

Thanks all for your feedback.

Simon

2

This sort of thing isn't really possible at this stage.

3

Thanks Mark for your feedback.

I'm just doing another where I'm doing the cumulative duration in my code.

So now I have 3 documents looking like this
1 | 2016/02/15 11:00:00 | step_1 | S | 00:15:00 | 00:15:00
2 | 2016/02/15 11:15:00 | step_2 | F | 00:35:00 | 00:50:00
3 | 2016/02/15 11:50:00 | step_3 | S | 01:10:00 | 02:00:00
4 | 2016/02/15 13:50:00 | step_4 | S | 00:05:00 |02:05:00

I injected those data in elastic and now want to visualize the last column (Y-axis) based on the 2nd column (X-axis)

I tested my first 'visualization' and notice the Y-axis must 'aggregate' data, can't I just graph the raw values?

Simon