Visualization based on two queries

In my index I have entries like:
entry 1:
id: A, quantity: 70
entry 2:
id: A, cost: 23

entry 3:
id: B, quantity: 50
entry 4:
id: B, cost: 24

Is there a way to make a cost vs quantity plot, where corresponding quantity and cost are linked by common ID? I don't need to do this directly in the Kibana. Could be some logstash/elastic/filebeat processing. I just couldn't find a solution.

This would best be solved external to Kibana. I would recommend writting a process in your favorite coding language that combines documents as needed and then inserts those into a new index.

how is it possible to have duplicate id in index? I thought ID is unique field in index

if I have entry like following then it is easy.

id:A, quantity:70, cost:23
id:B, quantity:50,cost:24

ID in this context is a Device ID and I have two processes requesting different data from the machine. So the first process asks device A for quantity and the second for cost. I guess it should be redesigned if there is no simple mechanism to handle it.

if you can combine this from linux system level it will work and then it will be easy solution for you.

for example you run a linux bash script on host1, collect info from deviceA and B and combine them

Create a csv file and read that.
you csv file should look like this

and you use csv input,
filter {
csv {
separator => ","
columns => [ "device", "quantity","cost" ]

and that will give you desire output

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.