Use var_set in markdown and conditional coloring for markdown

Elastic Stack Kibana
1

I am attempting to do the following:

var_set name="total" value={filters | timefilter column="createDate" from ={string "now-" {var "queryTimeframe"} "h"} to="now" | escount index"queries*" query="source:test"}
| var_set name="error" value={filters | timefilter column="createDate" from ={string "now-" {var "queryTimeframe"} "h"} to="now" | escount index"queries*" query="source:test AND (status:error or status:cancelled)"}
| var_set name="errorPct" value={math {string value={var "error"} value=" /" value={var "total"}}}
| markdown {var "total"} " Errored queries in " {var "queryTimeframe"} " hrs"
  font={font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" color={if {var "errorPct"} {gt 0.3} then "red" else "green"} align="left"
| render

But this isn't working. How can I use one of the variables in the Markdown element and then a different variable in the 'if' statement?

2

Hi @Mike_Clarke,

I haven't tested your expression, but at first glance, it seems that the if function might be used incorrectly. In expressions it is possible to omit the default parameter name and immediately write the value, this is what you are doing in the if function, but it seems you are providing the default parameter twice.

{var "errorPct"} {gt 0.3}

Would it solve your problem if you provided a single default parameter, something like this:

if {var "errorPct" | gt 0.3} then="red" else="green"

or 

if condition={var "errorPct" | gt 0.3} then="red" else="green"
3

@Vadims_Daleckis Thanks for the response and it seems to have fixed my conditional however I realized that neither var_set is being calculated correctly. I tried simplifying to something like this:

var_set name="total" value={filters | timefilter column="createDate" from ={string "now-" {var "queryTimeframe"} "h"} to="now" | escount index"queries*" query="source:test"}
| var_set name="error" value={filters | timefilter column="createDate" from ={string "now-" {var "queryTimeframe"} "h"} to="now" | escount index"queries*" query="source:test AND (status:error or status:cancelled)"}
| markdown {var "error"} " errors out of " {var "total"} " total queries"
| render

And the output is 0 errors out of 0 total queries. Both of those values are greater than 0.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.