Is it possible to make arithmetic operation on kibana dashboard?

[FTOR]

I would like to visualise the average of a processing time of a file according to its size over time.
I receive the fields as follows:
start_date
end_date
length

So I need to calculate length / (end_date - start_date) for each file and calculate the average

[stephenb (Stephen Brown)]

Hi @FTOR

Assuming all those fields are in a single document.

You can use Lens with Formulas .. .make a table or graph pretty easy

Or you could use a Runtime Field .... and create the field based on the calculation and the you could use in visualizations etc.

[FTOR]

thank you for your response !
I tried the formula function with Lenz. The Math functions doesn't work with fields. This is an example of the error with divide function. It's the same error with all Math functions
. And subscribe is only available with numeric fields. Is there a function available with dates ?

Concerning run time field, I add one to an index, but i could not see the result when I do search docs and I could not find the field on dashboard

*********creation of index*********
PUT /index_example/
{
  "mappings": 
  {
    "runtime": 
    {
      "result_dureeTraitement": {
        "type": "double",
        "script": {
          "source": "emit(doc['count']/(doc['end']-doc['start']))"
        }
      }
    },
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "count": {
        "type": "integer"
      },
      "end": {
        "type": "date"
      },
      "start": {
        "type": "date"
      }
    }
 }
}

********* post one doc ************ 
POST /index_example/_doc
{
	"@timestamp": "2023-04-17T17:53:30",
	"count" : 105500,
	"end" : "2023-04-17T17:53:30",
	"start": "2023-04-17T17:52:30"
}
********result *************

{
  "took" : 518,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "index_example",
        "_id" : "7Cr7j4cB_IrF2OdwhxSj",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2023-04-17T17:53:30",
          "count" : 105500,
          "end" : "2023-04-17T17:53:30",
          "start" : "2023-04-17T17:52:30"
        }
      }
    ]
  }
}

[stephenb (Stephen Brown)]

Hi @FTOR

You are close but missing a few key concepts ...

1 runtime fields are fields not _source so if you had run your search

GET index_example/_search
{
 "fields": [ "*"] 
}

The result would be

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
          "emit(doc['count']/(doc['end']-doc['start']))",
          "                                 ^---- HERE"
        ],
        "script": "emit(doc['count']/(doc['end']-doc['start']))",
        "lang": "painless",
        "position": {
          "offset": 33,
          "start": 0,
          "end": 44
        }
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
.....

Bad Definition

So now on to the solution / Suggestions

First when you are new to runtime fields use the Data View / Interactive UI to do it.

Remove the index, remove the bad runtime mapping and start over.

Put your mapping in without the runtime field
Add the Doc
Create A Data View and Add a Runtime Field

Now you can work on it interactively

Next you need to look at the painless docs ... especially around dates .. it is basically Java

dates are ZonedDateTimes types

So not sure if you have seconds or millis... there is a couple ways to do it

Here is my code there are several ways, also this does not protect against missing value etc...

long differenceInMillis = ChronoUnit.MILLIS.between(doc['start'].value, doc['end'].value);
double average = (double) doc['count'].value / differenceInMillis;
emit (average);

Now that that works ... you can add it to the actual mapping of you like

[FTOR]

Hi @stephenb, thank you very much ! It works great !