We have a problem creating a Pie Chart, there’s no way to implement this aggregation in Kibana.
We want to make a Unique Count of ID and make the aggregation with the LAST HIT OF STATE (last hit considering the last TIMESTAMP). For example, we have the following LOGS:
{“ID”:”1”, “STATE”:”Start”, “TIMESTAMP”:”01/01/2019”}
{“ID”:”2”, “STATE”:” Start”, “TIMESTAMP”:”01/01/2019”}
{“ID”:”3”, “STATE”:” Start”, “TIMESTAMP”:”01/01/2019”}
{“ID”:”4”, “STATE”:” Start”, “TIMESTAMP”:”01/01/2019”}
{“ID”:”1”, “STATE”:”In progress”, “TIMESTAMP”:”03/01/2019”}
{“ID”:”2”, “STATE”:”In progress”, “TIMESTAMP”:”02/01/2019”}
{“ID”:”1”, “STATE”:”Pending”, “TIMESTAMP”:”02/01/2019”}
{“ID”:”2”, “STATE”:”Pending”, “TIMESTAMP”:”05/01/2019”}
{“ID”:”3”, “STATE”:”Pending”, “TIMESTAMP”:”02/01/2019”}
{“ID”:”1”, “STATE”:”End”, “TIMESTAMP”:”04/01/2019”}
And we want a Pie Chart that represents the following count:
Start: 1 (ID = 4)
In progress: 0
Pending: 2 (ID = 2 and ID = 3)
End: 1 (ID = 1)
We tried to create a DSL query that gives us only the lost with the last state, like this:
{“ID”:”1”, “STATE”:”End”, “TIMESTAMP”:”04/01/2019”}
{“ID”:”2”, “STATE”:” Pending”, “TIMESTAMP”:”05/01/2019”}
{“ID”:”3”, “STATE”:”Pending”, “TIMESTAMP”:”02/01/2019”}
{“ID”:”4”, “STATE”:” Start”, “TIMESTAMP”:”01/01/2019”}
But we don’t know how to save this query as SAVE SEARCH so we can create a pie chart later with this saved search.
How can we create a pie chart as described above or save a DSL as a Save search?