As continuation of this question: https://discuss.elastic.co/t/kibana-range-based-on-count/
I would like to now display this data over time. Kind of like this:
Which is backed by the following expression:
filters
| essql
query="SELECT COUNT(*) as patches_applied, hostname, source, HISTOGRAM(timestamp, INTERVAL 1 DAY) as hist
FROM \"vulnerability-report\"
WHERE
(\"vulnerability-report\".os != 'Unknown')
GROUP BY hostname,hist,source" count=5000
| mapColumn "range"
fn={getCell "patches_applied" | switch case={case if={all {gte 0} {lt 10}} then="0-10"} case={case if={all {gte 10} {lt 50}} then="10-50"} case={case if={all {gte 50} {lt 100}} then="50-100"} default="100+"}
| sort by="range"
| pointseries x="hist" y="unique(hostname)" color="range"
| plot defaultStyle={seriesStyle lines=2 fill=1 stack=1}
palette={palette "#1ea593" "#2b70f7" "#ce0060" "#38007e" "#fca5d3" "#f37020" "#e49e29" "#b0916f" "#7b000b" "#34130c" gradient=false}
| render
However there is a big problem in that this count
parameter, when set to high enough value, simply crashes the browser. In this case, the unique combinations of hostname
, hist
andsource
taken over that period of time amount to over 20000 entries (overall number of documents over that time period is little over 2 million) and that's enough to crash the browser.
Is it maybe possible in timelion?
I could not find any way filter on aggregated count in timelion.
The screenshot above is correct structurally but is basically only showing a subset of the data ordered by hostname, and does not accurately represent the situation