State Change for Alarms

[karnamonkster (Karan)]

Hi,

I have a peculiar use case where we have multiple devices generating alarms of different nature.
I have Field Named: Event and the data looks like:
date_time|alarm_type|device1|on

corresponsing to that device i have another event
date_time|alarm_type|device1|off

Now i need to know how i can:

1. Identify the time taken for the alarm to reach from on to off
2. Provide a visualization to identify the Average time in alarm before acknowledgement or it went off.
3. Frequency of alarm_type

Any help on the matter is highly appreciate.

[ppisljar (Peter Pisljar)]

First i would suggest to index your data in a way that each of the parts of your field date_time|alarm_type|device1|off is a separate field, so datetime field, alarm_type field, device field and value/state field

also you can use https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html
to calculate the elapsed time you from on to off event.

once this is done calculating average time should be really straight forward (just use average aggregation on the elapsed field).

for calculating the frequency, what exactly would you expect to see there ? N alarms per hour or something like this ? that should be easy as well once alarm_type is a separate field.

just do a date histogram with a fixed interval and use count as a metric.

then you could probably use time series visual builder and its calculation aggregation

[karnamonkster (Karan)]

@ppisljar
Hi Peter,
Thanks for providing me exactly what i was looking for, here are some more insights on the setup i have.
Yes, i have my data indexed with all the fields such as

• date_time
• alarm_type
• deviceid
• state
• unique_id (corresponding to each device ID with alarm type)

Now like on and off i have multiple alarm states like
alarm & normal
open & closed
...

Based on the documentation for elapsed filter, should i be adding multiple tags to achieve what i intend to?

For the frequency, i need to know the frequency of a specific type of alarm and be able to further drill down.

For the rest i will let you know how it goes as per your brilliant suggestions.
Thanks again.

[karnamonkster (Karan)]

@ppisljar
Hi Peter,

I was successfully able to create the elapsed filter to get the elapsed_time for my events with one issue

1. The timefield to look at for calculating elapsed_time? ,since i have multiple timestamp fields.
2. There are some negative values in the elapsed_time field which is generated.
3. How Add a field which stores some attributes like %{alarm_type}%{unique_id} ifnegative values are calculated for elapsed_time field?

Again Thanks for your help.