Timelion-style queries

Elastic Stack Elasticsearch
1

I want to calculate the ratio of two counts, per minute, over a longer period. I can do this in timelion easily

'.es("myquery").divide(.es())'

But I'm stuck on how I can generate a query to display this data.

I can get a data histogram for *, and a date histogram for "myquery", but I'm stuck on getting ES to do the arithmetic for me. Is this even possible?

The use case: I monitor this ratio (2* or 3* response codes as a portion of total hits, in web logs) in realtime by pulling a single value for each filter for the timestamp lte now and gte now-1m and dividing one by t'other. I now want to pull historical data.

I have a weird feeling that significant terms agg with the percentage heuristic could do this under certain bizarre conditions: after all, it's not so different to comparing a filtered value against a background count, within a date histogram agg. But maybe I'm way off.

tia,
Tom

2

I would love to have a way to do this in Kibana or Elastic itself also. For now we are just going to use Timelion for it.

3

Even a way to view Table / Response data would be a good start for me, like in the rest of Kibana. Viewing the graphs doesn't help.

4

It's kind of a pain, but I have occasionally just exported the data from Kibana into excel and ran my own functions on it.

5

How do you export the data from a timelion viz?

6

in latest Kibana 4.5 you can integrate timelion inside your kibana dashboard with certain limits on how the filtering is done.
filter you apply to the dashboard don't apply only time filrering for the moment.

7

Yes, I can view the data in Kibana (even without switching to the Timelion plugin). But I don't want a picture, I want the data and/or a way to get it.

In the core visualisations you can see the Request and Response... but not in a 'Timeseries' (ie Timelion) viz