Visualisations - Display records with zero count

Elastic Stack Kibana
1

I'm trying create a visualization and find IDs where there is a zero count over a given time period. For example, if we have data such as

ID Date
1 01-OCT-2018
2 01-OCT-2018
1 02-OCT-2018

I'd like a visualization that would report that ID=2 has zero records for the period of 2nd Oct 2018. I don't really care which chart type it's displayed on - but is this possible in Kibana?

2

You can't do that in a visualization per se, but you can achieve this using the Advanced Threshold alert in Watcher.

watcher_advanced
watcher_advanced.png1666×801 42.6 KB

You can't really display it in a Kibana dashboard unless you do something a bit convoluted:

  1. Set it to the Log action.
  2. Set logstash to auto-ingest the Kibana log and filter only these watcher messages.
  3. You can create a visualization based on these messages.
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.