Timelion: secondary axis as yesterday total cusum?

[joaociocca (João Ciocca)]

So! Wild guess here: I've been trying to get it on my own, but I'm running out of ideas on how this could be achieved. The idea would be to have the main axis as points and the secondary as line, with it being the cumulative sum of yesterday - no matter the interval set for the chart.

I thought "interval" on .es() could make this work, something along the lines of .es(q='*',interval='time:(from:now-1d%2Fd,mode:relative,to:now-1d%2Fd)').cusum() maybe could work, just like the parameter on dashboard URL, but nothing shows up =(

I hate to use this word, but is it impossible to achieve this?

((edit)) maybe I could feed a .static() with the .max() of yesterday... I'd still need to find how to use that interval, maybe I'm doing it wrong? ((/edit))

[Nathan_Reese]

Using interval parameter in the es source is not recommend. Below is the help text for interval.

You can use offset parameter to show yesterdays data.

.es(index=kibana_sample_data_logs*,timefield=@timestamp).bars()
,.es(index=kibana_sample_data_logs*,timefield=@timestamp,offset=-1d).bars().label('yesterday')

[joaociocca (João Ciocca)]

Thanks Nathan! I saw that *do not use*, but I couldn't help myself to not try it.

I thought about using the offset option, but I'm not sure it would do exactly what I want... the idea would be to have a single line drawn, like the .static does, but showing the max cumulative sum of yesterday.

To take from your example... I'd want a way to do something like this:

.es(index=kibana_sample_data_logs*,timefield=@timestamp).bars()
,static(value=.es(index=kibana_sample_data_logs*,timefield=@timestamp,offset=-1d).max(cusum())).lines().label('yesterday')

Which, of course, I've tried but to no success. So the idea would be for my main chart to show the current running values, and the static line show what was yesterday's final total... does this makes sense?

[Nathan_Reese]

I don't think this is currently possible. You can open a feature request at https://github.com/elastic/kibana/issues/new?template=Feature_request.md