Kibana: Range based on count

Elastic Stack Kibana
3

@megakoresh I believe this is doable in Canvas.

I've come up with an example Canvas expression using the Kibana logs sample data set, which I think matches your use case, that plots unique hosts vs range of patches.

06%20PM
Screen Shot 2019-09-13 at 12.56.06 PM.png1482×622 6.44 KB 

filters
| essql 
  query="SELECT COUNT(*) as patches_applied, host FROM \"kibana_sample_data_logs\"
GROUP BY host"
| mapColumn "range" fn={
    getCell patches_applied 
    | switch case={case if={all {gte 0} {lt 2000}} then="0-2000"}
      case={case if={all {gte 2000} {lt 4000}} then="2000-4000"}
      default="4000+"
  }
| sort by="range"
| pointseries x="range" y="unique(host)"
| plot defaultStyle={seriesStyle bars=0.4} yaxis={axisConfig tickSize=1}
| render

This element queries ES using ES SQL and grabs the total count per unique host. Then we use mapColumn to create a new range column that maps each total to a range using a switch function. Then this pipes into a pointseries function which sets your x-axis to the range field and the y-axis to unique(host) which grabs the number of unique values from the host field and renders as a vertical bar chart using the plot function.

1 Like