Visualize percentage of time where logs exist / buckets are full

I am sorry if this better fits in Elasticsearch; feel free to move it!

I am currently trying to visualize something for the first time and it doesn't seem to be simple.
My data consists of simple events that contain an ID of the machine they belong to and not much of interest otherwise. They basically "ping" that an item was created.

Now my ultimate goal is to visualize the "efficiency" of each machine, that is, given an interval the percentage of that time that the machine was producing stuff, where it counts as "not producing anything" when there was no ping for x minutes (say 5).

Is this even possible in kibana with this kind of data?
I thought about making a bucket aggregation with bucket size of 5 minutes, then I could theoretically divide the number of full buckets by the total number of buckets. I don't even see how I could do this, let alone that the next step would be to average these results over all machines.
I hope I'm just not seeing something here, but I'm prepared to learn that it's impossible like this.

Any pointers are greatly appreciated, for example what my data lacks to make this happen. For instance the time between two events of the same machine could maybe be calculated on the server.

I thought about making a bucket aggregation with bucket size of 5 minutes, then I could theoretically divide the number of full buckets by the total number of buckets. I don't even see how I could do this, let alone that the next step would be to average these results over all machines.

I think like this could be accomplished using the Bucket Script pipeline aggregation in a TSVB visualization. So maybe start there and see what is possible.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.