I have an index of documents each representing a login event, from a particular device (deviceId) at a particular time (loginTime).
I want to create a Metric Visualization showing how many devices have been logged in from, which I can easily do as a Unique Count of deviceId. But I want that Metric to be filterable based on when the devices were first logged in from (i.e., activated). So for example, I want to see how many devices were first activated during the month of July, 2020.
If I simply filter the underlying index based on the loginTime, it will first limit my documents to those from July, 2020, and then give me a count, even if a particular device also had a login/document from June, 2020, and should not have been included.
What I want to do is:
- First aggregate my documents to give me the minimum loginTime for each device
- Then apply the Kibana Dashboard Time Filter to those results, based on the aggregated minimum loginTime
- Then get a total count of the matching devices and display it in my dashboard
I'm guessing that, if this is at all possible, it will probably involve using Vega. But I'm not quite sure how to put it all together. Any guidance will be appreciated.
I'm using Kibana 7.4.2.