Update kibana filters using values from a different field


(Edoardo Vaccaro) #1

Hi,
I'm using the ELK stack to do some performance monitoring on java methods inside my app. I'm also trying to do some execution time profiling. Thus, I'm storing events in which I have current method name and also some stack trace in form of a path.

ELK stack version: 6.4.1

I'm storing events of this kind for first level methods' calls:

{
	"@timestamp": "2018-11-14 14:55:40,674",
	"message": {
		"current": "iecsmas.Service4Test.doSomething",
		"parent": {
			"path": "null",
			"success": true
		},
		"executionTime": [40],
		"executionTimeSum": 40,
		"samples": 1,
		"success": true,
		"eventType": "apiMonitor"
	}
}

where:

  • parent.path is always null
  • current is current method name (with shortened package name and full class name)

The same event is also used to store callee informations (when available).
The same model can assume these values for callee methods:

{
	"@timestamp": "2018-11-14 14:55:40,690",
	"message": {
		"current": "iecsmas.SubService4Test.doSomethingCorrect",
		"parent": {
			"path": "iecsmas.Service4Test.doSomething",
			"success": true
		},
		"executionTime": [16, 8],
		"executionTimeSum": 24,
		"samples": 2,
		"success": true,
		"eventType": "apiMonitor"
	}
}

where:

  • parent.path is the caller method or a path o caller methods (with shortened package name and full class name)
  • current is current method name (with shortened package name and full class name)

As you can see, the second event is a callee of the first event.
I'm taking in account multiple callee invocations in the same caller execution, within the array of executionTime.

Now, I'm trying to build a dashboard to show single methods' trends and enable some drill down.
First visualization is something like a pie for topmost called methods, usually on first level (ie. with parent.path = null). This should be easily done with a filter on parent.path field and a pie on a terms aggregation on current field.
What I'm failing to achieve is to update parent.path filter by clicking on a pie slice, since slices are populated with current field values. Moreover, for a further drill down I would like to combine parent.path value with current value.

Filter values should be as follow:

First call:

  • parent.path = null

Second call, after clicking on iecsmas.Service4Test.doSomething slice

  • parent.path = iecsmas.Service4Test.doSomething

Thirc call, after clicking on iecsmas.SubService4Test.doSomethingCorrect

  • parent.path = iecsmas.Service4Test.doSomething/iecsmas.SubService4Test.doSomethingCorrect

Is it possible to apply a calculated value in a field filter?