Time since last response

[tomwood (Thomas Wood)]

I'm trying to create a visualisation in Kibana dashboard that shows the UP Time of some API's and also shows when they last logged a response into Elastic. I want to colour each api's info green, amber or red, depending on when they last logged a response to elastic. How would I go about doing this?

I can only seem to get it to show the up time or last response time but not colour it or group it by time since the last response

[nickpeihl]

Hi Thomas. I think you would need a formula in Lens like last_value(timestamp, kql='timestamp: *') and use the Color by value option. Here's an example screenshot.

[tomwood (Thomas Wood)]

Hi, I've tried that and it doesn't seem to work?
It doesn't like the type of the timestamp field?

[tomwood (Thomas Wood)]

Just thought it might be helpful info. I'm on Elastic 7.17.9 and can't update

[nickpeihl]

Hi Thomas. Sadly, last_value does not work with Datetime fields in v7.17. I was testing on v8.8.2.

You could create a runtime field on your index pattern to convert the timestamp to a double of epoch milliseconds. Then use that field in your formula.

This is the script I used for a runtime field called timestamp_epoch.

ZonedDateTime input = doc['timestamp'].value;
long milliSinceEpoch = input.toInstant().toEpochMilli();
emit(milliSinceEpoch)

Then I can use the formula last_value(timestamp_epoch) in my Lens visualization.