# Mean Time Between Failure Heartbeat documents

**URL:** https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945
**Category:** Beats
**Tags:** heartbeat
**Created:** [September 10, 2019, 5:16pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945 "2019-09-10T17:16:28Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mando\_mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mando_mat/32/45572_2.png) [@mando\_mat](https://discuss.elastic.co/u/mando_mat)
#### Post date: [September 10, 2019, 5:16pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945/1 "2019-09-10T17:16:28Z")

</div>

Hi,  
I'm trying to calculate the mean time between recovery and the mean time between failure of some services monitored by heartbeat. For example, for MTBR, for each service I would like to get the time elapsed between two successive documents with the same monitor.id and having monitor.status down and up respectively. How can I do that?

p.s. I can also do further offline operations once I have obtained the data.

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 10, 2019, 6:44pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945/2 "2019-09-10T18:44:13Z")

</div>

This is actually kind of tricky. I have a branch where I've been working on accurately doing this sort of work here: [https://github.com/andrewvc/kibana/tree/timelines](https://github.com/andrewvc/kibana/tree/timelines) . You can track this issue: [https://github.com/elastic/uptime/issues/55](https://github.com/elastic/uptime/issues/55) . It's on our roadmap. Once we have that underlying infrastructure we can calculate things like MTBR accurately.

---

<div class="post-metadata">

### Author: ![mando\_mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mando_mat/32/45572_2.png) [@mando\_mat](https://discuss.elastic.co/u/mando_mat)
#### Post date: [September 10, 2019, 7:34pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945/3 "2019-09-10T19:34:50Z")

</div>

Thank you so much for the information. In the meantime, could you point me to a workaround maybe working a little with aggregations?

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 10, 2019, 8:08pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945/4 "2019-09-10T20:08:37Z")

</div>

There's not really a great one that you can do in a single query. A prereq for timelines is including the frequency of the check with each message, which will let you calculate a somewhat accurate number for average time down over a period (just the sum of the frequency for all down checks). The timelines PR is more accurate (handling mis-scheduled items) but requires a lot of complex processing in JS.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 8, 2019, 8:08pm UTC](https://discuss.elastic.co/t/mean-time-between-failure-heartbeat-documents/198945/5 "2019-10-08T20:08:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
