Kibana compare two logs based on a log value

i have logs that contains a run_id and type of operation, for each unique run_id there are two possibilities for operation
so it looks like this:

"run_id": ["123"], "operation": ["a"]
"run_id": ["123"], "operation": ["b"]
"run_id": ["456"], "operation": ["a"]
"run_id": ["789"], "operation": ["a"]

i want to visualize which precentage of run_id has logs with both operations, so in the example above it will show me a 33.33% (could be in a number, a stacked bar or a pie chart, doesn't really matter)
can you do this in kibana?

Hi @mkan

welcome to the Kibana community.
I think the best it can be achieve at the moment is a table with the absolute number of "run_id" that satisfy the given criteria:

  • Pick the table visualization in Lens
  • Configure a Top Values by "run_id" of 1000 (or more values) and select the Collapse by sum option
    • if you have more than 10000 possible run_id values, then I suggest to add a Custom ranking column based on unique count of operation.
  • As metric you can use a formula like the following:
    unique_count(operation.keyword) / overall_max(unique_count(operation.keyword)) == 1
    , 1, 0)

In the formula above I assumed you do not know before hand the exact number of operations that can be applied.
Unless you know the total number of "run_id" before hand or via a field (i.e. something like a "current_running_ids" field for each record) unfortunately it's not possible to workout the percentage.
If you have such hypothetical "current_running_ids" field then you might compute a ratio in the fomula:

    unique_count(operation.keyword) / overall_max(unique_count(operation.keyword)) == 1
    , 1, 0) / last_value(current_running_ids)

Thank you for the response!
Right now my table visualization looks like this:

is there a way for me to not show a user_id if it only has an operation: “b” log?
So In that case the red row in the example photo would not appear in the table

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.