Visualization based on two queries

Elastic Stack Kibana
1

In my index I have entries like:
entry 1:
id: A, quantity: 70
entry 2:
id: A, cost: 23

entry 3:
id: B, quantity: 50
entry 4:
id: B, cost: 24

Is there a way to make a cost vs quantity plot, where corresponding quantity and cost are linked by common ID? I don't need to do this directly in the Kibana. Could be some logstash/elastic/filebeat processing. I just couldn't find a solution.

2

This would best be solved external to Kibana. I would recommend writting a process in your favorite coding language that combines documents as needed and then inserts those into a new index.

3

Nathan,
how is it possible to have duplicate id in index? I thought ID is unique field in index

if I have entry like following then it is easy.

id:A, quantity:70, cost:23
id:B, quantity:50,cost:24

4

ID in this context is a Device ID and I have two processes requesting different data from the machine. So the first process asks device A for quantity and the second for cost. I guess it should be redesigned if there is no simple mechanism to handle it.

5

if you can combine this from linux system level it will work and then it will be easy solution for you.

for example you run a linux bash script on host1, collect info from deviceA and B and combine them

Create a csv file and read that.
you csv file should look like this
A,70,23
B,50,24

and you use csv input,
filter {
csv {
separator => ","
columns => [ "device", "quantity","cost" ]
}

and that will give you desire output

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.