Percentage of docs which contain keyword in array field

[Jasper_Timm]

Hi there,

I have data with a field with values that are an array of strings. For each unique string, I'm trying to get it's percentage for the total doc count in the index, displayed as a bar graph for each keyword.

i.e.
doc1={field1:["a","b","c"]}, doc2={field1:["a"]},doc3={field1:["a","b"]}

a_perc=100%
b_perc=66%
c_perc=33%

Is this possible in Kibana at all? I realise I can get the count easily enough, but I'm strictly after the percentage of each to the total doc count.

[Bill_McConaghy]

Looks like this post might be of some help to you: Doing Math over count of events

[Jasper_Timm]

Thanks @Bill_McConaghy, that was a helpful link. After a lot of messing around I was able to get the stats I was after.

I'll give some feedback for others that might run into these issues as well as the Kibana devs for improvements.

The value to be calculated for me seemed completely trivial, I simply wanted the doc count of a filter (for a specific term in a field) over the total doc count. The filter_ratio was the way to go, but it took a lot of time messing around with the interval and the global time filter before I got the values I was expecting. I needed to use the Overall Average as Lee suggested in the linked thread, but even using that it still didn't give sensible values. All my docs had times within the last 90 days, but when changing the global time filter from 1 year to 2 or 5 years the values would change. I think it's not entirely obvious how this value is being calculated.

For the record, the way I set it up to get correct values was to explicitly set the interval in the Panel Options to '1y' (and NOT auto) and to set the global time filter to last 1 year (if I set it to 'this year' I get 0 values for some reason).

I think it's silly that the whole process requires such sensitive fine tuning for what I would assume is the most obvious value to be calculating for this ratio.

Screenshots:

[Bill_McConaghy]

Definitely agree that this could be made easier, and we very much appreciate you posting your solution in detail. That is very helpful to others who may have the same need.