More complicated calculation/visualisaton - is it possible?

[Frantisek_Sitler (František Šitler)]

Hello,
I have an issue to create a bit more complex calculation and visualization. It should take data from multiple indices, always an record will be connected via one field - IN number.
There is always multiple records with that number, recording status changes. I need to create some table or visualization, where it will be visible how IN went through statuses and when it changed status and how long it stayed in each.
Is it possible to achieve it?
Ie sample data is:

Number: IN2020
Time: 15.1.2020 12:20.00
Action: update
New status: created
Message; xxx

Number: IN2020
Time: 15.1.2020 12:40.00
Action: update
New status: assigned
Message; xxx

Number: IN2020
Time: 15.1.2020 13:40.00
Action: in progress
New status: created
Message; xxx

Number: IN2020
Time: 18.1.2020 12:20.00
Action: update
New status: closed
Message; xxx

And from that, I need to get a timeline with times. For sure, there will be much more IN numbers, so it has to be like a template which will automatically generate the info.
Later on, I will need to extend it with some other data from another index and calculate with some extra times, but... later on.

Does anybody have an idea how to achieve that?

Thanks

[Andrew_Tate (Drew Tate)]

Hi @Frantisek_Sitler ,

To use Elasticsearch data in Kibana, you first create a data view. The data view you create can match multiple indices, so that should cover your first requirement.

A saved search in Discover might get you close to that sequential table you described. They can also be embedded on a dashboard.

As for creating a table to follow the progress of a particular IN series, I would use Kibana Lens.

You should be able to add a filter to only get the documents with a particular ID
number

Let me know if this helps.