Timelion fraction offset

Elastic Stack Kibana
1

Hello

Is it possible to use timelion offset to compare the value of a metric, daily, at the same hour (from now, for instance)? My question is that we are not considering the complete day, but a fraction starting 0:00, everyday the same.

Thank you

Hugo

2

I guess this could be a good alternative on using ES SQL on time analysis.

3

You should be able to do this by using a scripted field "hour of day" (I think it's part of the logs sample data set). Create your timelion vis as usually, then add a filter pill below the query bar limiting the "hour of day" field to a certain range.

4

Could it be dynamic? Something like limiting to "current hour"?

5

Unfortunately not fully automated because you can't use Date.now() in scripted fields: Scripted Fields Date Math

You would have to change the range in the filter manually

6

I was trying timelion in alternative to ES SQL wich seems to me more dificult.
I was using

SUM (IF(@timestamp = MAX(@timestamp), 1,0)

to count the documents from the last period selected (dynamically) on the timefilter. But ES SQL doesn't allow me to use an aggregation function (MAX) inside an IF.