Display calculated fields in Kibana 4

Question

We use Kibana 4 to display usage statistics for our tools by logging entries using the "stats" flag.

This allows us to show that tool A has been executed 15 times in the last 60 minutes. Now using this tool saves time, i.e. For tool A, it saves users 3 minutes.

So, I would like to show on another chart how many minutes have been saved, i.e. we saved 45 minutes in the last 60 minutes to show real-time return on investment for a specific instrument.

Is there anyway to do this in ElasticSearch or Kibana (i.e. have a computed field that is multiplied by a fixed value based on a specific tool)? It would be great if the answer would provide a dynamic way to do this, that is, a calculated field, and then add redundant information to millions of past and future records.

Thanks Patrick

Answer 1

Kibana 4 supports script fields. You can add calculated fields and use them in visualizations. Script fields use the Lucene expression syntax .

From the kiban documentation :

You can refer to any numerical field with one value in expressions, for example:

doc ['field_name']. value To create a field script:

1. Go to Settings> Indices
2. Select the index template to which you want to add the script field.
3. Click the Script Fields tab.
4. Click Add Scripting Field.
5. Enter a name for the script field.
6. Enter the expression you want to use to calculate the values ​​on the fly from your index data.
7. Click Save Script Field.

Answer 2

Assuming you are using Kibana 3, you can save the time that the tool saves in each log event.

{tool: "A", timeSaved: 3} 

And then in Kibana you can use the histogram panel and use "total" for the values ​​of the chart: