Json input kibana calculations

annk · May 1, 2018, 2:29pm

Hi,

I am trying to plot a graph for mean time to failure , I have a watcher setup for this purpose which will give me alerts coming from different hosts .

I have got a line chart with count on Y axis and date histogram on x axis.
If I have Count 5000(Number of alerts) on a given day , how do I use json script to get MTTF= unique number of hosts / count ?

Any help appreciated.

spalger · May 1, 2018, 4:57pm

Hey @annk

I'm pretty sure you won't be able to calculate unique number of hosts / count in the standard Kibana visualizations, but it's pretty trivial to do with timelion:

.divide(.es(*, index=logstash*, metric=count), .es(*, index=logstash*, metric=cardinality:clientip))

annk · May 2, 2018, 9:00am

Thanks , This is what I have been looking for.
But does aggregation works for a text field ? I can only see number fields appearing in metric aggregations.

spalger · May 2, 2018, 5:53pm

Which aggregtation? The metric=cardinality:clientip? I'm using an ip address there, keyword fields should be available too.

annk · May 3, 2018, 11:02am

Yes , its working now . When I entered metric=cardinality:beat. , the suggestion list was empty which confused me.

es(, index=metricbeat-, metric=cardinality:beat.hostname) this worked for me.

system · May 31, 2018, 11:02am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.