Visualize how much time (24h) processes took on the server

[kwoxer (Curtis Mosters)]

I would like to have a diagram like this

But I was only able to get this one

This is the defined fields:

So my question are:

• how can I show hours instead of the second?
• how to have bars that show the second but on hover it shows the Success/Error/...?

So the main aim is to see how much time our processes took on the server. And as there can only be one process at the same time it cannot be more then 24 hours.

[flash1293 (Joe Reuter)]

Just to make sure I correctly understand what you are trying to do - the tooltip on hover should show a different breakdown than the bars of the chart, correct (bars should show number of runs by result, hover tooltip should show seconds per process)?

If yes, this is not possible to achieve with a single chart today - it's not possible to show different data in the tooltip, it's always bound to what's visible in the chart. What about two separate charts (one for the result breakdown, one for the seconds per process) next to each other on a dashboard? This seems like an easier way to digest the same information.

[kwoxer (Curtis Mosters)]

Well the hover info is nice to have. So yes this could be also in another chart.

But the issue with the seconds is more heavy. How to get it a hours in the chart?

[flash1293 (Joe Reuter)]

Ah, missed that, sorry.

This sounds like a good use case for a runtime field: Manage index pattern data fields | Kibana Guide [7.13] | Elastic

In your case a runtime field hours would be calculated by dividing the value of the field seconds by 3600 - then you can build the chart using hours.

[kwoxer (Curtis Mosters)]

Did not work for me to also show 4 comma values. So I now create minutes and hours on filebeat side directly and works. But thank you.

[flash1293 (Joe Reuter)]

Glad it worked out. If someone stumbles over this later - the most likely issue is an integer field value. To return a decimal value for the runtime field, the it has to be casted before the division:

emit((double)doc['myField'].value / 3600)