Timelion series matching specific field

Elastic Stack Kibana
1

Hi, i have a problem with my time series data in Timelion.
For example, I have a set of cars, that have index 'car' and every document besides different metadata has the most important for me fields: price (i may collect several price value for the data) , model (e.g. Mercedes) and date (the appropriate data of the price for the model was got from the market)
I want to gain time series data to see the price of the specific (e.g. only for Mercedes) car for this date,
I started to use this query:
.es(index=car, q='model:Mercedes', timefield='date', metric='max:price').color(ff0000)

then i try to change the model and watch the difference:
.es(index=car, q='model:BMW', timefield='date', metric='max:price').color(ff0000)
and i get the same chart, that is not true.

after this i tried to split the models in one chart:
.es(index=car,split='model:5', timefield='date', metric='max:price').color(#ff0000)
and i get only one line.

The thing that a i want to do may be got from the if conditional, but the if operator must be number or series, but i need the String: .es(q='model').if(eq,Mercedes,.es(timefield='date', metric='max:price')) but it couldn't be done.

Of course, i 've checked that the data for different models is defferent and exist.
Please, help me to get this data like i've described to you.

2

Hi @sanek640,

which Version of the Elastic Stack are you using? Would it be possible for you to show us the mapping of the car index?

3

Elastic 5.6.3
I can't provide the exact structure, but it is smthg like this. If you think the key may be in there, i may check:

Mapping 
{
	"car": {
		"mappings": {
			"mycar": {
				"properties": {
					"price": {
						"type": "float"
					},
					"date": {
						"type": "data"
					},
					"model": {
						"type": "text"
					}
				}
			 }
		 }
	 }
}
4

I assume that data is supposed to mean date in this example? In order to split on the field model it would have to be indexed as a keyword. If you enter the queries model:Mercedes and model:BMW into the Discover search bar, do you see the correct subset of documents?

5

"date" of course, sorry.
In the primary mapping, "model" has field "keyword" with a type keyword, you are right.
Yes, i see.

6

I tried reproducing the problem with the information I got from you so far, but failed. If you split on model, what is the label of the one series that is displayed?

7

I will have 5 different labels, but all of them return the one line, like they are the same prices for all of the models, that is not right. i may hide every label and don't notice the changes, i will notice them only if i hide all of them.

8

The problem is that i dont get the unique prices for the models, but i got the same whether i chose the BMV model or Mercedes

9

Sorry, I misunderstood you there. So you get 5 identical series, which means that for each bucket the maximum price is the same.

To give me a better idea of how the values are distributed, would it be possible to run the following query after substituting the <FROM> and <TO> placeholders for the timestamps of the interval you are looking at in timelion and post the results?

GET car/_search
{
  "query": {
    "range": {
      "date": {
        "gte": <FROM>,
        "lte": <TO>
      }
    }
  },
  "size": 0, 
  "aggs": {
    "models": {
      "terms": {
        "field": "model",
        "size": 5
      },
      "aggs": {
        "price_stats": {
          "extended_stats": {
            "field": "price"
          }
        }
      }
    }
  }
}
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.