Visual Time Builder filter limitation

[Alexandre_Juma]

Hi all,

I'm having a hard time achieving some simple stuff I normally do with Timelion.

The use case is quite simple (i.e: % of distinct clients with specific condition):

cardinality(field) metric (with applied filter)
divide
cardinality(field) metric (no filter)
multiply x 100

In timelion I would do something like this:

.es(index='myindex', q="DownStream_RXPOWER:>4.9 || DownStream_RXPOWER:<-4.9", metric='cardinality:MAC_CM').divide(.es(index='myindex', metric='cardinality:MAC_CM')).multiply(100).label("%Of Unique Clients with problem")

In visual time builder, the "Group by filter" seems to affect all metrics created in the label with doesn't let me create a variable for the calculation that is not affected by the filter.

Does anyone knows how work around this? Or am I seeing things wrong?

BR
AJ

[simianhacker (Chris Cowan)]

Check out the "filter ratio" aggregation, it allows you to set a filter for the numerator and denominator. Then choose which aggregation you want to use for the values (cardinality of a field is an option).

FYI... I just noticed a bug where you can't choose a string field for the cardinality in the filter ratio so I'm submitting a PR for that right now.

[simianhacker (Chris Cowan)]

It should look something like this:

Here is the PR for fixing the cardinality feature in "filter ratio": https://github.com/elastic/kibana/pull/13762