Kibana compare two logs based on a log value

[mkan]

i have logs that contains a run_id and type of operation, for each unique run_id there are two possibilities for operation
so it looks like this:

"run_id": ["123"], "operation": ["a"]
"run_id": ["123"], "operation": ["b"]
"run_id": ["456"], "operation": ["a"]
"run_id": ["789"], "operation": ["a"]

i want to visualize which precentage of run_id has logs with both operations, so in the example above it will show me a 33.33% (could be in a number, a stacked bar or a pie chart, doesn't really matter)
can you do this in kibana?

[Marco_Liberati]

Hi @mkan

welcome to the Kibana community.
I think the best it can be achieve at the moment is a table with the absolute number of "run_id" that satisfy the given criteria:

• Pick the table visualization in Lens
• Configure a Top Values by "run_id" of 1000 (or more values) and select the Collapse by sum option
  • if you have more than 10000 possible run_id values, then I suggest to add a Custom ranking column based on unique count of operation.
• As metric you can use a formula like the following:

ifelse(
    unique_count(operation.keyword) / overall_max(unique_count(operation.keyword)) == 1
    , 1, 0)

In the formula above I assumed you do not know before hand the exact number of operations that can be applied.
Unless you know the total number of "run_id" before hand or via a field (i.e. something like a "current_running_ids" field for each record) unfortunately it's not possible to workout the percentage.
If you have such hypothetical "current_running_ids" field then you might compute a ratio in the fomula:

ifelse(
    unique_count(operation.keyword) / overall_max(unique_count(operation.keyword)) == 1
    , 1, 0) / last_value(current_running_ids)

[mkan]

Thank you for the response!
Right now my table visualization looks like this:

is there a way for me to not show a user_id if it only has an operation: “b” log?
So In that case the red row in the example photo would not appear in the table