Is it possible to have multiple SQL queries into the Expression Editor?

Elastic Stack Kibana
1

For the context, I have a query that brings me data from the last 24hous. And would like to have a second column which will deal only with information from the last 6minutes.

The thing is, if I do both like:

@timestamp" >= NOW() - INTERVAL 24 HOUR
@timestamp" >= NOW() - INTERVAL 6 MINUTE

It will take the data from the 24hours and only show the 6minutes of it, wont work. So I was thinking if maybe there is an option for it in expression editor. What do you guys say?

2

Hello Samuel,

Yes, you can create a table based on the results of two essql queries, joined into one table. Just like in this example:

var_set

name="logs" value={essql "select count(*) as a from kibana_sample_data_logs"}

name="commerce" value={essql "select count(*) as b from kibana_sample_data_ecommerce"}

| createTable ids="totalA" ids="totalB"

| staticColumn name="totalA" value={var "logs" | getCell "a"}

| alterColumn column="totalA" type="number"

| staticColumn name="totalB" value={var "commerce" | getCell "b"}

| alterColumn column="totalB" type="number"

| mathColumn id="percent" name="percent" expression="totalA / totalB"

| render

You can read more about it here.