Json input kibana calculations



I am trying to plot a graph for mean time to failure , I have a watcher setup for this purpose which will give me alerts coming from different hosts .

I have got a line chart with count on Y axis and date histogram on x axis.
If I have Count 5000(Number of alerts) on a given day , how do I use json script to get MTTF= unique number of hosts / count ?

Any help appreciated.

(Spencer Alger) #2

Hey @annk

I'm pretty sure you won't be able to calculate unique number of hosts / count in the standard Kibana visualizations, but it's pretty trivial to do with timelion:

.divide(.es(*, index=logstash*, metric=count), .es(*, index=logstash*, metric=cardinality:clientip))


Thanks , This is what I have been looking for.
But does aggregation works for a text field ? I can only see number fields appearing in metric aggregations.

(Spencer Alger) #4

Which aggregtation? The metric=cardinality:clientip? I'm using an ip address there, keyword fields should be available too.


Yes , its working now . When I entered metric=cardinality:beat. , the suggestion list was empty which confused me.

es(, index=metricbeat-, metric=cardinality:beat.hostname) this worked for me.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.