Reference the count of a field name in metrics

Elastic Observability Metrics
1

I would like to have calculation like you see in the image.

grafik
grafik1346×464 31.6 KB

How to solve that?

I was trying:

{
  "script" : 
    {
    "lang": "painless",
    "inline": "_value * params.manualSeconds / params.correction / params.factorCount",
    "params" : {
      "manualSeconds" : 600,
      "correction" : 100,
      "factorCount" : count('FIELDNAME')
    }
  }
}

But does not work.

2

@kwoxer thanks for your question. We'd like to route this to the right team. Can you tell us more about what part of Kibana (and what version) you are using for this?

1 Like
3

Sure, here the info:

  • Kibana v 7.8.1

And part of Kibana? Well I just want to create some calculations. So in this example I have a timespan and want to know how much time my robot saved compared to when a human would have done it.

So as you can see the robot ran 3 times. And the average completion rate is 60% (where the robot stopped at in the process, e.g. stopping because there was data missing or so), that 60% value came from 80%, 50% and 50% btw. The Seconds Saved stands for how much seconds the robot saved. So as example the manual run of 100% of the process takes 600 seconds. So the 60% of 600 are the 360 seconds. And finally the Seconds Saved * Count are what I'm interested in. So currently I only know how much one is saving. Now I want to multiply it with the overall Count.

So At the end it would also be fine to only see one value. But this with the table is also very interesting. I would like to have both actually.

How to do that?

4

Ohh and I also tried to use the Metric explorer but the Chart is always empty. And I also didn't find out any tutorial that helped me there. Not sure what I do incorrect there. I tried out any different Average and graph per and so on:

grafik
grafik1580×404 31.8 KB

5

@kwoxer Is STATISTIC-TRANSACTION-COMPLETE-RATEa scripted field you created in an index pattern? If so, the Metrics Explorer doesn't have support for those fields... yet. We are working on integrating with Kibana index patterns and ultimately the new runtime fields implementation which will be perfect for stuff like this.

6

Nop, its a normal field. Is there no way in referencing like a described in my example above?

7

Not for Metrics Explorer, you can do that using TSVB (under Visualizations). We are working on supporting runtime fields via Kibana index patterns. Unfortunately, I don't have a timeline for when that will be released.

8

Good to know, yes that is looking kind of what I need. But now how to reference the count? Really hard to understand. Or is it impossible with the TSVB?

grafik
grafik1305×995 60.4 KB

9

I just solved my issue kind of with the Sum of a Scripted field. But as Scripted fields are slower and very static I would more prefer a better way if possible. Also I also need this 1680 seconds value as visualization. Sure I could now hide the other values simply but it will still remain as a table. I would rather prefer a vis of the metrics showing big value. Any tips on this?

grafik
grafik1025×343 23.1 KB

10

What about using a bucket script? Since it's a pipeline aggregation it is only operating on aggregated data so you shouldn't see a performance hit.

image
image2546×2562 464 KB

1 Like
11

Cool that worked.

image

Maybe the last question. As you can see on SCANUC process, when there is no field in the TimeSpan. Is there any way to just show a 0 maybe instead of no data?

But this is really just cosmetic, overall it works have many thanks.

12

Is that a TSVB visualization?

13

Yes it is.

14

That happens where there is ZERO rows returned. Maybe we need a "No Data" view or a way to configure it so either it shows the default "No data" message or just displays ZERO for the value.

1 Like
15

Should I open a feature request for this?

But again thanks. But really hidden feature I would say.

16

Yes, if you could open an issue here: Issues · elastic/kibana · GitHub

1 Like
17
18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.