Timelion - metric=median query?

I am using timelion to do sum and averages, but is there an internal metric function to determine median?

example:
.es(offset=-24h,index=system_stats*,interval=5m, timefield='@timestamp', metric=avg:downnodes, q=island_type:cpu)
.divide(.es(offset=-24h,index=system_stats*,interval=5m,timefield='@timestamp', metric=avg:capacity, q=island_type:cpu))
.multiply(100)

Hi Imran. I think you could use the percentiles aggregation can find the median (50th percentile).

For example I created this expression to return only the 50th percentile for a packetbeat field.
.es(index=packetbeat-*,metric=percentiles:http.response.body.bytes:50)

1 Like

Thank you, this is exactly what I'm after and it works.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.