Latest value in a gauge

[luc.c]

Hi,
I'm having trouble building a gauge based on two relevant fields: requestID and Status.
My goal is to show the number of requestID for each status; it is not a cumulative count though, as the same requestID can assume different statuses during a period of time, so I need to consider just the latest one for each request. How can I consider just the latest statuses? is it correct to use @timestamp? (running on KIBANA 6.2.3).
Thanks.

[wylie (Wylie Conlon)]

Hi, welcome to the forums! Your version of Kibana is very old, but I think that my advice here is true for your older version as well.

You basically have two options here:

a. Change the data that you have stored in Elasticsearch, so that you represent only the latest status per requestID. If you do this you will be able to make the visualization you want using a Gauge.

b. Use Vega to create a fully custom visualization, where you will build an aggregation and then apply more aggregations in Vega. Vega was first introduced in Kibana 6.2, so you should have it. Vega | Kibana Guide [master] | Elastic

[luc.c]

Hi,
thanks for the reply.
I think I will try the second option, but I have two question:

1. what's the format: {property: ""} for the gauge?
2. Can I use only the field @timestamp or also requestID?
   I don't know the Vega visualization.
   Thanks

[wylie (Wylie Conlon)]

You can build a gauge-like visualization called a bullet chart using Vega-Lite, like this example. The format: { property piece of the Vega spec is extracting a specific path from the JSON response from elasticsearch. It's documented here. You can use any elasticsearch query.