Lens Line Chart - Average of Sum of Fields Per Session

Elastic Stack Kibana
1

I want a line chart that shows the average length of a web session. The issue is that we are logging the numeric value in 4 separate parts with no total logged. Here are my fields per log line:

SessionID = 123
Resource = Jump
Length = .038

SessionID = 123
Resource = Run
Length = .027

SessionID = 123
Resource = Swim
Length = .056

So each SessionID has 3-4 different log lines. I want the sum of Length on all log lines per session - giving me a total length for the session. Then I want to display the average of all of the sessions in the line chart.

Any ideas?

2

Hi @sfageol

In the example above, you want a SessionID: 123 series that is .038 + .027 + .056 at t0, correct?

3

I'll try to clarify. Each of these groups of 3 is a log line:

SessionID = 123
Resource = Jump
Length = .038

SessionID = 123
Resource = Run
Length = .027

SessionID = 123
Resource = Swim
Length = .056

SessionID = 999
Resource = Jump
Length = .055

SessionID = 999
Resource = Run
Length = .076

SessionID = 999
Resource = Swim
Length = .039

I want to sum the 3 lengths for each SessionID:

SessionID 123 = .038+.027+.056
SessionID 999 = .055+.076+.039

And then display the average of the totals on a line chart.

4

I see.
One last question: each entry there has a timestamp, right? For each session how long would be the span of it?

Is it something like a daily session and the line chart should see how the session total length changed over time?

5

The timespan is extremely short. This is an iFrame and I want the line chart to show how long it takes to load the iFrame. So typically the total time span should be under a second or two but possibly a bit more.

6

mm ok.
Do you mind sketch the final chart result? Just to be sure we're talking about the same thing

7

End goal is something like this:

image
image1910×628 73.4 KB

8

I think what you can do is the following in Lens:

  • configure a Line chart for one layer
  • configure a date histogram over the Horizontal axis
  • configure a metric over the Vertical Axis as:
    sum(Length, kql='Resource: Jump) + sum(Length, kql='Resource: Run') + sum(Length, kql='Resource: Swim')
  • configure a break down by SessionID and then configure a collapse by: Average
  • now duplicate the layer (top right -> Duplicate layer)
  • tune the Break down dimension in the new layer by SessionID and then configure a collapse by: Max