Removing zeros from a Timelion metric

Elastic Stack Kibana
1

Hi all!

I'm trying to display the average CPU temperature of a set of devices, but I need to remove the zeros, as they (obviously because devices are not in the freezer :smile: ) mean that the temperature sensor is just malfunctioning. I'm trying to do this with a Lucene query, but I cannot make it work with the NOT operator.

I've been investigating a bit on this and on Lucene queries in general, and I could not find much, apart from some hints that NOT conditions cannot be used in Lucene without other positive operators, but I'm surprised because removing certain values from a calculation seems like a pretty basic need, right?

This is my query right now. It's giving a syntax error (if I remove the "NOT", it works fine):

.es(index=device_monitoring*, timefield=dt_EventTimestamp, metric=avg:vl_CPU_Temperature, q=NOT vl_CPU_Temperature:0)

Thanks a lot in advance for your insight!

2

Hi @InesCM

I think you miss quotes in your expression. I checked it with sample data on 7.12.1:

timelion2
timelion23240×1596 304 KB

Give it a try this. way:
.es(index=device_monitoring*, timefield=dt_EventTimestamp, metric=avg:vl_CPU_Temperature, q='NOT vl_CPU_Temperature:0')

This blog post might give you more insights around timelion

Regards, Dzmitry

3

Totally worked, thanks so much, Dzmitry!