Suggestions for presenting data

[Cylindric (Mark Hanford)]

I posted a question recently about cross-tabulation of data, and I thought rather than try and create what is in my head, I'd see if anyone can suggest a different way of presenting the data I need.

So I have a bunch of documents representing messages being sent. Each record has a destination address, and a status to say whether it sent or not.

2016-12-02 01:00:00 alice@a.com   success
2016-12-02 01:00:00 bob@b.com     success
2016-12-02 01:00:00 charles@c.com fail
2016-12-02 02:00:00 alice@a.com   fail
2016-12-02 02:00:00 bob@a.com     success
2016-12-02 02:00:00 charles@a.com fail

And what I currently report is a summary of destinations, and how successful sends are:

address     sent success%
--------------------------
alice@a.com   2    50%
bob@b.com     2   100%
charles@c.com 2     0%

I don't seem to be able to create such a visualisation in Kibana, so I was wondering if someone else had any suggestions.

The key bit to report on is which ones have the worst success rate, regardless of the total number sent, so some way of showing the "Top 20 Bad Addresses" would probably do.

Thanks

[spalger (Spencer Alger)]

I don't think you will be able to render a table that shows the percentage of requests that failed for a specific user. You get that in a chart by splitting on username and then status and rendering it in a percentage style, but probably won't be super useful.

I would probably start with something like this:

A dashboard that shows the percentage of failed/successful messages, the total number of messages, and the total number of failed messages for the top failure destinations.

By putting these together on a dashboard you can spot when an abnormal amount of failures occur, spot which destinations are most affected, and click on any of those destinations to drill down and see their specific breakdown.

Does that help?

saved objects:

• index pattern
  • messages, time as timefield
• search
  • failed messages, query: status:fail
• visualizations
  • top failure destinations, based on "failed messages" search, terms agg on to field
  • Success vs Failure, area chart based on "messages" index pattern, date_histogram on time and split area by status
  • Total Messages, metric vis based on "messages" index pattern, count of all documents