Hi folks. I'm trying to reproduce a dashboard, so I can move us off a 3rd-party product onto ElasticSearch and Kibana.
One visualisation I'm having trouble with is a table, with totals depending on a record status.
Here's an example. We have a bunch of record that has on it a "type" which might be a customer for example "alice", "bob", "charles". It also 'message.status' which might be "okay" or "failed".
Each type will have many records, with any of the statuses.
I'd like to have a table such as:
Type Count Okay Failed
---------------------------------
Alice 10 10 0
Bob 234 230 4
Charles 91 5 96
I can get the numbers by splitting the table by the term "status", but then I end up with a bunch of tables, not one table. Is there a way of doing that sort of crosstabulation?
ElasticSearch 2.4.1
Kibana 4.6.1