Unable to plot custom data on Y axis

Elastic Stack Kibana
1

I have 1000 lines of data which is in below format and I want to plot a line graph in Kibana with response time on y axis and time on x axis and then plot the data based on Interface name. In below data there is only 1 interface name but in 1000 lins of data there can be unique 3-4 interface name. When i am plotting this data i am only getting option of count on y axis and time on x axis (which is ok) but i am not able to map response time filed on y axis.

{"level":"INFO","CommandName ":"Get","timestamp":"2020-04-02T00:01:10.224","Status":"SUCCESS","MethodName":"executeCommandAndProcessResponse()","ResponseTime":"63","RID":"http-f799140e7128","ResponseCode":"0","Msisdn":"2348064427272","InterfaceName":"XYZ","ClassName":"com.ericsson.fdp.business.command.impl.TransactionCommand"}

Looking forward for a solution..

2

Hi @ishan1

I think you will first need to add Split Series bucket to split the data on the interface name. When making the Line Chart in Visualize, under the "Buckets" section, you should be able to click Add > Split Series. Since you are just splitting on a the interface name, select a "Terms Aggregation" and then your InterfaceName field. That should split the single line into multiple lines for you.

Let me know if you have anymore questions.

3

Hello Corey
Thanks for the prompt response but the solution provided isn't what we are currently facing.

The actual issue which I am facing is:

How to plot response time field on y axis, given the condition that we don't need the count of response time on y axis (as its taking on default), we need to plot the actual values of it. Once the actual values are plotted on y axis we will plot "timestamp" on x axis and then based on "InterfaceName" (as you suggested) will will plot a line graph which should give us the information about "ResponseTime"
for a particular "InterfaceName" at any given point of "timestamp".

Basically if you see a share market line graph for a particular share it provides information about its price on y axis and time on x axis and by that graph we come to know its price at any point of time. Similarly with our data I want to know the ResponseTime at any point of timestamp for a particular "InterfaceName".

I am using 6.4.2 as Kibana version.

I hope i made my problem clear now.
Looking forward for your response.

4

I see. So you currently your y-axis is the count of documents for that timerange, and not the actual value of ResponseTime?

If that is the case, you will need to change your Y-Axis Metric from Count to, for instance, Average and select the ResponseTime field as the field to calculate the average on.

If you could share a screen shot of what your configuration currently looks like, I'd be happy to assist with showing what you may need to change.

Hope that helps!

5

Hello Corey
Yes you got the problem right, i just tried with average and got this error " No Compatible Fields:".

Below is one block from 1000 blocks I inserted into Kibana as raw data.

{"level":"INFO","CommandName ":"Get","timestamp":"2020-04-02T00:01:10.224","Status":"SUCCESS","MethodName":"executeCommandAndProcessResponse()","ResponseTime":"63","RID":"http-f799140e7128","ResponseCode":"0","Msisdn":"2348064427272","InterfaceName":"XYZ","ClassName":"com.ericsson.fdp.business.command.impl.TransactionCommand"}

Can you please specify which configuration are you looking for..

6

It looks like the ResponseTime field is ingested as a string, this is why you can't use the average aggregation. When you specify your mapping, make sure ResponseTime has a number type, e.g. integer: https://www.elastic.co/guide/en/elasticsearch/reference/current/number.html

1 Like
7

Thanks

I understood what you said. Is there any way i can change its type now or do I need to load the data again with ResponseTimeas integer.

8

You can define the mapping under a different name and then use the reindex api to shovel the data over.

9

Thanks Everyone, i got what i intended to.
Thanks a lot:-)

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.