Timestamp distribution hour of day

Elastic Stack Elasticsearch
1

All the events in my index are _timestamp enabled. I would like to look at
a distribution of events based on the hour of day.

Here is an example of what I would like to query:

http://blog.redowlanalytics.com/post/78135922786/generating-realistic-fake-communications-data

Is that possible? Can that be done on a histogram in kibana?

Thank you.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/6dad4af2-bc57-4326-9619-0d5eb4d9d6ba%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Did you try an histogram on _timestamp?

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 2 juin 2014 à 03:55, Kevin S kevinsteger@gmail.com a écrit :

All the events in my index are _timestamp enabled. I would like to look at a distribution of events based on the hour of day.

Here is an example of what I would like to query:

http://blog.redowlanalytics.com/post/78135922786/generating-realistic-fake-communications-data

Is that possible? Can that be done on a histogram in kibana?

Thank you.

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/6dad4af2-bc57-4326-9619-0d5eb4d9d6ba%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/5A7B98DB-C9FB-41E1-87C1-A69F82396C3B%40pilato.fr.
For more options, visit https://groups.google.com/d/optout.

3

hello,

I don't see how an histogram on _timestamp could be a solution. If I understand correctly, Kevin is looking for a way to create histogram on "hour of _timestamp", so every events between 2am and 3am should be in the same bin even if they belong to different days.

On 02 juin 2014, at 06:57, David Pilato wrote:

Did you try an histogram on _timestamp?

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 2 juin 2014 à 03:55, Kevin S kevinsteger@gmail.com a écrit :

All the events in my index are _timestamp enabled. I would like to look at a distribution of events based on the hour of day.

Here is an example of what I would like to query:

http://blog.redowlanalytics.com/post/78135922786/generating-realistic-fake-communications-data

Is that possible? Can that be done on a histogram in kibana?

Thank you.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/D0341EC0-1EA0-4C98-A56D-6109ED8E3DC6%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

4

That is correct. Events between 2-3am even on different days would appear
in the same "bucket"

On Sunday, June 1, 2014 10:16:33 PM UTC-7, Patrick Proniewski wrote:

hello,

I don't see how an histogram on _timestamp could be a solution. If I
understand correctly, Kevin is looking for a way to create histogram on
"hour of _timestamp", so every events between 2am and 3am should be in the
same bin even if they belong to different days.

On 02 juin 2014, at 06:57, David Pilato wrote:

Did you try an histogram on _timestamp?

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 2 juin 2014 à 03:55, Kevin S <kevin...@gmail.com <javascript:>> a
écrit :

All the events in my index are _timestamp enabled. I would like to look
at a distribution of events based on the hour of day.

Here is an example of what I would like to query:

http://blog.redowlanalytics.com/post/78135922786/generating-realistic-fake-communications-data

Is that possible? Can that be done on a histogram in kibana?

Thank you.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/f489a71a-1909-44c0-abaa-731326df1bb9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

5

I was looking for this myself the other day.
You can get the results you want from ES with the following aggregation:

{
"aggs": {
"hour": {
"terms": {
"script": "doc['@timestamp'].date.hourOfDay"
}
}
}
}

For Kibana, you'd probably need a Histogram panel that is note date based.
That is, you need a custom Kibana panel.

On Sunday, June 1, 2014 10:55:36 PM UTC-3, Kevin S wrote:

All the events in my index are _timestamp enabled. I would like to look
at a distribution of events based on the hour of day.

Here is an example of what I would like to query:

http://blog.redowlanalytics.com/post/78135922786/generating-realistic-fake-communications-data

Is that possible? Can that be done on a histogram in kibana?

Thank you.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4f04cafa-d6bb-403d-876e-d6ed7f5f52c5%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.