Timelion aggregation- Possible with terms?

Elastic Stack Kibana
1

Hey Guys!

Im trying to graph a formula using add, divide and multiple functions of Timeline. I wanted to know if it was possible, and if so how to add aggregation of terms to my Timeline equation.

Right now, what I think I have is adding 3 different values together in the same index.

A+B+C:

.es(index=indexWanted*, q=termSpecifyingWhatSectionIwant:sub111a-ion, metric="sum:valueOneThatiWantToAddTogether").sum(.es(index=indexWanted*, q=termSpecifyingWhatSectionIwantr:sub222-ion, metric="sum:valueTwoThatiWantToAddTogether").sum(.es(index=indexWanted*, q=termSpecifyingWhatSectionIwantr:sub333-ion, metric="sum:valueThreeThatiWantToAddTogether")

I have a few meters reading in data, and I want to find the total value passing these meters together, but I have a few meters in the system Id like to keep out, which is why I can't just take the sum off all sub*

Thank you in advance!

1 Like
2

You can do a terms aggregation on the first query and then do a sum on top, but it won't let you do two splits and add them back together - the data may not line up after.

If the first option works for you it would look something like
.es(index=foo-*, split=my_field:5)........ The number proceeding my_field is the number of terms.

if that doesn't work for you, can you share a little more about what you're trying to do? It might be worth looking into a different approach. Can you filter out the meters with a query instead of subtracting?

3

Hey Jon,

My formula uses many different terms (data.meter)'s value (data.datum) example of one:

t _type Index_wanted
'# data.datum 777
t data.meter sub11a-ion

I want to use the data.datum value for the following equation, which means that I need to get the data.datum values from different terms. (Not sure if I am using the correct lingo)

(sub1 +sub2 +sub5+ sub32 + sub108 -(sub20 through sub30)(total power))/ (total load)

I don't actually want to split anything, because all these data points will go into the above equation, which will make a point and go onto the timelion graph ( in theory at least)!
Cheers,
Lindsey

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.