Json input kibana calculations

[annk]

Hi,

I am trying to plot a graph for mean time to failure , I have a watcher setup for this purpose which will give me alerts coming from different hosts .

I have got a line chart with count on Y axis and date histogram on x axis.
If I have Count 5000(Number of alerts) on a given day , how do I use json script to get MTTF= unique number of hosts / count ?

Any help appreciated.

[spalger (Spencer Alger)]

Hey @annk

I'm pretty sure you won't be able to calculate unique number of hosts / count in the standard Kibana visualizations, but it's pretty trivial to do with timelion:

.divide(.es(*, index=logstash*, metric=count), .es(*, index=logstash*, metric=cardinality:clientip))

[annk]

Thanks , This is what I have been looking for.
But does aggregation works for a text field ? I can only see number fields appearing in metric aggregations.

[spalger (Spencer Alger)]

Which aggregtation? The metric=cardinality:clientip? I'm using an ip address there, keyword fields should be available too.

[annk]

Yes , its working now . When I entered metric=cardinality:beat. , the suggestion list was empty which confused me.

es(, index=metricbeat-, metric=cardinality:beat.hostname) this worked for me.