Multi level Transform with Elasticsearch

Elastic Stack Elasticsearch
1

Hi,

I have different logs just like this:

timestamp = A, group = B, objectCount= C

timestamp = A, group = B, object = D, value = E
timestamp = A, group = B, object = F, value = G

I already use a Transform which group by "group"/"object" and do calculation with "value".

How can I add to this "entity-centric" view the field "objectCount" at the "object" level?

I would like something as:

  • group by "group"
  • select "objectCount"
  • group by "object
  • Do some stuff with objetCount and value

Thanks!

2

Anyone?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.