Showing documents with a certain index fiel

Elastic Stack Kibana
1

I would like to make a pie with one slice being "good" and the other being "bad". a document is considered "bad" if it has a certain field. How can I do this?

2

there are a couple of ways you could try to solve this:

  • at index time create additional field like good with boolean value
  • or create a scripted field to check for this condition
  • or use filter aggregation, where one filter would be: {"exists":{"field":"machine.os.raw"}} and the other one: {"bool":{"must_not":{"exists":{"field":"machine.os.raw"}}}}

i hope this gives you some ideas and helps you to solve your problem.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.