Kibana Visualization of Pipeline Aggregation

Elastic Stack Kibana
1

After much pain I was able to create the pipeline aggregation below in the console. But, I can't figure out how I am supposed to get it into a visualization. I just want to create a guage to display the "availabile_percent"

POST /app-health/_search
{
  "aggs": {
    "availability_pct": {
      "terms": {
        "field": "entityId.keyword",
        "size": 10
      },
      "aggs": {
        "success_count": {
          "sum": {
            "script": {
              "source": "if (doc['availability.keyword'].size()>0) { if (doc['availability.keyword'].value == 'AVAILABLE') { return 1; } } return 0;"
            }
          }
        },
        "total_count": {
          "value_count": {
            "script": {
              "source": "return 0;"
            }
          }
        },
        "available_percent": {
          "bucket_script": {
            "buckets_path": {
              "success": "success_count",
              "total": "total_count"
            },
            "script": "params.success / params.total * 100"
          }
        }
      }
    }
  }
}
2

You have two options. One is to try to recreate this query using one of the tools in Kibana, most likely by using TSVB. For example, the TSVB filter ratio function could work:

Numerator: availability.keyword: AVAILABLE
Denominator: availability.keyword: *

The most direct way of doing this is to use Vega. It's the only way to use the full Elasticsearch DSL in Kibana. You can follow my new tutorial for your first Vega visualization, which I wrote for the upcoming 7.9 version, but that is pretty close to existing versions: https://www.elastic.co/guide/en/kibana/7.9/vega-graph.html

3

Thanks Wylie, I was able to get this working with one potential problem. I only got the expected results if my selected timeframe equals the interval:

Timeframe: last 24 hours
Interval: 24h

Does anybody know if there is a way to set your interval equal to the timeframe?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.