Kibana :: Count if the id not exist for the event

Elastic Stack Kibana
1

hi,

I have a data like this:

id : 1,event: event1
id: 2,event:event1
id: 2,event:event2
id:3,event:event1

Need to count the ids having only event1 not in event2
expecting is 2 count

2

You can do this by using a metric visualization with a "Unique count" on the id field. Then, to exclude the "event2" ids, add a filter below the search bar in the top - you can exclude the value event2 from the event field. If you save the visualization and put in on a dashboard, this filter will be saved along with the visualization and applied as well.

3

This is not worked as still id counts

4

It's helpful if you could provide more context. Could you make a screenshot of your configuration?

5

sure... will provide. before that would like to say... that leadId contains other events too...

6

image will be posted

7

posted:

8

I'm still not sure what exactly you want to achieve - it would really help if you would provide more context, not just little snippets.

An important note about how Kibana works:
In Visualizations you define filters (on the top) and aggregations (in the side bar). The filters are applied first, that means all documents in your index are filtered down according to the filters. After that, the aggregations are applied to the remaining documents. The result is shown as a chart.

If this is about filtering out documents based on the fact whether other documents exist, this is not possible using your raw documents. You might want to get familiar with transforms: https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html Those offer a way to transform your documents by grouping them in some way.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.