Hi all, thank you all for the support.
I'm trying to create an specific chart on Timelion that does some simple math to display a percentage.
My data index is something similar to this:
On our index we have:
event.id (not necessary now)
error message (not necessary now)
sd.device.cpu0.p_system (necesarry now, will display 0 or a 100)
recepcion.kpi_total (necessary now, will display an integer number)
What we want to do with this data is using the data on the recepcion.kpi_total field do the following math:
(sd.device.cpu0.p_system:"0") * (100) / (sd.device.cpu0.p_system:"0" + sd.device.cpu0.p_system:"100")
I can't come to a conclusion of getting the same result on any other way with Kibana.
So to clarify, i'd like to get the percentage of this chart by using the data on the recepcion.kpi_total field just like this simulated indexed data:
sd.device.cpu0.p_system = 0 and recepcion.kpi_total = 8 --> 80%
sd.device.cpu0.p_system = 100 and recepcion.kpi_total = 2 --> 20%
The percentage of sd.device.cpu0.p_system that have 100 as value on the global of the index is 20%.
The timelion query i came up with is the following:
.es(split=event.id:10,index=protom-m2m, timefield=@timestamp, metric=count).fit(mode=average).lines(fill=0,stack=false,width=2).multiply(100).divide(.sum(.es(index=protom-m2m, q='sd.device.cpu0.p_system:"0" AND NOT error.message:"ERRPR003"', timefield=@timestamp)),(.es(index=protom-m2m, q='sd.device.cpu0.p_system:"100" AND NOT error.message:"ERRPR003"', timefield=@timestamp))).label("$1", "^.* > event.id:(\S+) > .*")
but i'm getting this error message:
[timelion_vis] > Error: in cell #1: Cannot read property 'multi' of undefined
I'm really scratching my head over this, does anyone know if i'm doing something really wrong on this timelion query?
Thank you very much to all.
Alex.