Timelion visualization - getting average of events grouped by id

[Sabika (Sabika Rizvi)]

Hi, I am tryng to calculate average of a group of events by calculating the difference between min and max timestamps and then dividing by count.

1. Split events by an ID
2. For each of these groups calculate time taken(by subtracting min timestamp from max timespamt)
3. Calculate avg for the time taken
   I am using Timelion and splitting the events by an ID. However, I might be doing something wrong because this looks like it is creating multiple buckets. Here is my query:

<.es(index=filebeat-,q="",metric='max:@timestamp',split=context_id.keyword:10).subtract(.es(index=filebeat-,q="",metric='min:@timestamp',split=context_id.keyword:10)).divide(.es(index=filebeat-,q="",metric='count',split=context_id.keyword:10))/>

What i am seeing is

What I expect to see is a continous line graph.

Can you please help here? I can use any other visualization as well to get this done, but have been trying in timelion so far.

[ryan1969 (Ryan Manus)]

@Sabika

What I expect to see is a continous line graph.

Can you please help here? I can use any other visualization as well to get this done, but have been trying in timelion so far.

Hello,

It seems like you’re on the right track with your Timelion query, but the issue you’re encountering is due to the split function creating separate series for each context_id. To achieve a continuous line graph representing the average time taken for all events, you’ll need to aggregate the results of your calculations into a single series.

Here’s a revised version of your query that should help you get a continuous line graph:

.es(index=filebeat-, metric='max:@timestamp', split=context_id.keyword:10)
.subtract(.es(index=filebeat-, metric='min:@timestamp', split=context_id.keyword:10))
.divide(.es(index=filebeat-*, metric='count', split=context_id.keyword:10))
.aggregate('avg')

This query will calculate the max and min timestamps for each context_id, subtract them to get the duration, divide by the count to get the average, and then use the .aggregate('avg') function to average these values across all context_id buckets.

Make sure to replace filebeat-* with the actual index pattern you’re using if it’s different. Also, adjust the split parameter if you need to analyze more or fewer context_id buckets.

I hope my suggestion is helpful for you.

[Sabika (Sabika Rizvi)]

Hello Ryan, Thanks for your assistance here. There is still a problem in that I still see multiple lines - one for each context id.

What I want to achieve is a single line which will show the average time for all the context ids.