Visualisations - Display records with zero count

[singhster (Simon Singh)]

I'm trying create a visualization and find IDs where there is a zero count over a given time period. For example, if we have data such as

ID Date
1 01-OCT-2018
2 01-OCT-2018
1 02-OCT-2018

I'd like a visualization that would report that ID=2 has zero records for the period of 2nd Oct 2018. I don't really care which chart type it's displayed on - but is this possible in Kibana?

[Marius_Dragomir]

You can't do that in a visualization per se, but you can achieve this using the Advanced Threshold alert in Watcher.

You can't really display it in a Kibana dashboard unless you do something a bit convoluted:

1. Set it to the Log action.
2. Set logstash to auto-ingest the Kibana log and filter only these watcher messages.
3. You can create a visualization based on these messages.