Tabulating data based on a field

Elastic Stack Kibana
1

Hi folks. I'm trying to reproduce a dashboard, so I can move us off a 3rd-party product onto ElasticSearch and Kibana.

One visualisation I'm having trouble with is a table, with totals depending on a record status.

Here's an example. We have a bunch of record that has on it a "type" which might be a customer for example "alice", "bob", "charles". It also 'message.status' which might be "okay" or "failed".

Each type will have many records, with any of the statuses.

I'd like to have a table such as:

Type         Count  Okay  Failed
---------------------------------
Alice           10    10       0
Bob            234   230       4
Charles         91     5      96

I can get the numbers by splitting the table by the term "status", but then I end up with a bunch of tables, not one table. Is there a way of doing that sort of crosstabulation?

ElasticSearch 2.4.1
Kibana 4.6.1

2

It isn't possible to do that with the data table currently. Instead of doing split tables, you could do split rows to keep it in all in one table. The fields okay and failed will become row data instead of column data, but the information you're looking for should be available. There's an enhancement request here.

3

Thanks. At least I know not to waste time trying to get it working. I can probably get the data presented nicely in other ways - I'm hoping my colleague will tell me that most of the columns aren't needed. At the moment it's worse than my example above, as he gets name, total, and then subtotal "okay" and subtotal "failed", and also "okay %" and "failed %".

We'll get there :slight_smile: The cost of the service we'll be cancelling more than pays for an Elastic Cloud setup.