Tsvb - Sort by bucket script's value?

Elastic Stack Kibana
1

My data contains informat about several companies sending mail. Each document contains

company name (tenant_name)
sending domain
total amount of mails sent (total_volume)
amount of mails considered spam (spam_complaints)

PUT /myindex
POST _bulk
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_1", "total_volume": 33, "spam_complaints": 10 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_2", "total_volume": 33, "spam_complaints": 5 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_a", "domain": "domain_3", "total_volume": 34, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_2", "total_volume": 333, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_3", "total_volume": 333, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_b", "domain": "domain_4", "total_volume": 334, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_3", "total_volume": 3, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_4", "total_volume": 3, "spam_complaints": 1 }
{ "index": { "_index": "myindex" }}
{ "date": "2020-01-08", "tenant_name": "company_c", "domain": "domain_1", "total_volume": 4, "spam_complaints": 2 }

What I like to get is the percentage of spam per company over the time. I already solved that using tsvb.

image
image838×488 20.3 KB

But when it comes to grouping (by term "tenant_name") I can only order by total_volume or spam_complaints. Both is not sufficient as I would need to order by the percentage of spam_complaints (so by spam_complaints/total_volume).

Looking at the data you can see that each metric (total_volume, spam_complaints, percentage) would give a different order:

image
image1042×380 108 KB

I currently see no way how to achieve the ordering by percentage, in this case so that company_c would be top.

2

Elasticsearch is not able to sort buckets of pipeline aggregations, which is why TSVB doesn't give you that option.

Related: https://github.com/elastic/kibana/issues/12178

3

Thanks Tim.
Is there another way I could achieve the result I like? Meaning: Get an overview of every company's spam-quota per day where I only see the top n with the highest quota?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.