Perform calculation on metric aggregation in visualization

We have a requirement to calculate the overall TAT(turnaround time) of the system. In our application a package is flown from many modules sequentially and each module do some operations on the package and move forward. So we have entry of in and out of each module in elastic.
The need is to calculate time difference between "in time" of first module and "out time" of last module. that should give us the over all time taken by the system
I have achieved to get the "in time" and "out time" for each package using min and max aggregation but not able to use this aggregation value to perform operation.
I have attached the related stuff. I need to get the difference between In Time and Out Time column

My sample data is :slight_smile:
PUT package/doc/11
{
"package_name": "Test",
"in_timestamp" : "2019-02-13T13:15:30Z",
"app_name" : "Test APP 1"
}

PUT package/doc/12
{
"package_name": "Test",
"out_timestamp" : "2019-02-16T13:16:30Z",
"in_timestamp" : "2019-02-14T13:15:30Z",
"app_name" : "Test APP 1"
}

PUT package/doc/13
{
"package_name": "Test",
"in_timestamp" : "2019-03-02T13:18:30Z",
"app_name" : "Test APP 2"
}
PUT package/doc/14
{
"package_name": "Test",
"out_timestamp" : "2019-03-03T13:20:30Z",
"in_timestamp" : "2019-03-02T13:18:30Z",
"app_name" : "Test APP 2"
}

PUT package/doc/15
{
"package_name": "Test",
"in_timestamp" : "2019-03-03T13:21:30Z",
"app_name" : "Test APP 3"
}

PUT package/doc/16
{
"package_name": "Test",
"out_timestamp" : "2019-03-04T13:25:30Z",
"in_timestamp" : "2019-03-03T13:21:30Z",
"app_name" : "Test APP 3"
}

I think this what you would need for the Elasticsearch query: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-scripted-metric-aggregation.html

However, I'm not sure that this is supported by Kibana visualizations. If you could change the way you are storing the in/out times so that they are all fields on a single document, then you could use a scripted field to calculate the time spent and then use this field in a visualization.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.