Timelion count with a condition

Elastic Stack Kibana
1

I have a need for doing a timelion count of a certain field (myField)... but only if another field (errorField) is not 0.

So I made a scripted field: myFieldIfNoError
if (doc['errorField'].value != null && doc['errorField'].value != 0){ return doc['myField'].value; } return null.

.es(index=myindex,timefield=myTimeStamp,metric=count:myFieldIfNoError)

But the count is still counting the 0 and null values. I only want a count of myField when errorField is not 0.

What's the right thing to do?

2

hi @Joseph_Mak,

I would have the scripted field return either 0 and 1 and then instead of doing a count, do a sum() on that field. That will give you the count, and omit the documents with the 0-value.

3

Thanks that seems to do the trick (was thinking I probably need a .if())