I created an index from a Storm topology to ElasticSearch (ES). The index map is basically:
index: btc-block
miner: text
reward: double
datetime: date
From those documents I would like to create a histogram of the richest miner, on a daily scale.
I am wondering if I should aggregate first in storm and just use ES and Kibana to store, query and then display the data or if ES and Kibana can handle such requests.
I have been looking at the Transforms, in the index management section, that allows to create new indices from queries and aggregations in continuous modes but I can't succeed to get to the expected result.
Any help will be appreciated.
Sometimes we need to ask a question to find the answer...
I kept looking at the documentation and eventually I could solve the issue by using a sibling pipeline aggregation, in the visualization. In my case, a max bucket aggregation of the sum of reward on Y-axis.
In that case get like 6 records/hour so I guess it's ok to let Kibana and ES work. What if I got lot more data? Would it not be wiser to aggregate in Storm?
Related
I'm playing around the package github.com/olivere/elastic; all works fine, but I've a question: is it possible to get the last N inserted documents?
The From statement has 0 as default starting point for the Search action and I didn't understand if is possible to omit it in search.
Tldr;
Although I am not aware of a feature in elasticsearch api to retrieve the latest inserted documents.
There is a way to achieve something alike if you store the ingest time of the documents.
Then you can sort on the ingest time, and retrieve the top N documents.
I am using Elastic Cloud v 7.5.2. I am trying to transform the index, where i want the term count to be aggregated. In Kibana UI, Define Pivot does not have provision to take terms aggregation. How to achieve it? Is the version didn't support or we can achieve the same using Transform API?
we have a field eventType which will have values like task-started, task-completed, task-inprogress. Each document will have an jobId and each job can have multiple tasks. I need to transform the index to a new index in such a way where task-started, task-completed and task-inprogress will be separate field and it will have value count aggregated to it.
Our ultimate goal, in Kibana we need to show additional columns which will have percentage and ratio of these task fields.
I'd like to automate a features creation process for large dataset with elastic search.
I'd like to know if it is possible to create a new field in my dataset that will be the result of an aggregation.
I'm currently working on log from a network and wants to implement the moving average (the mean of a field during the past x days) of the filed "bytes_in".
After spending time reading the doc and example, I wasn't able to do so ...
You have two possibilities:
By using the Rollup API you can create a job that will allow you to summarize data on the go and store it in a dedicated index.
A detailed example can be found in this blog article.
By using the Data Frame Transform API, you can pivot your data into a new entity-centric index, aggregate your data in various ways and store the results in a dedicated index.
I am using elastic search for the project I'm working on and I was wondering if there was a way to narrow the results I get from an indices stats search.
https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-stats.html
I currently use the docs to narrow the data I get back about the indices but now I want to only get back ones with a doc count greater than 0. Does anyone know if this is possible or how to?
Thanks!
For elastic search 1.5.2
If you're concerned about the size of the response (i.e. if you many many indices with many shards), the best you can do is to use response filtering (available only since ES 1.7) and only retrieve the docs field that you can further filter on the client-side:
curl 'localhost:9200/_stats/docs?pretty&filter_path=**.docs.count'
Let's say I have a log of events of ad displays and ad clicks stored via Logstash in Elasticsearch and displayed in Kibana 4. I would like to calculate a simple metric like CTR (Click-Through-Rate) of the events , which is :
CTR = #clicks/#displays.
First of all, does anyone know if it's possible to do in Elasticsearch + Kibana? I don't see a possibility to do it in Kibana.
I was thinking about doing it in raw Elasticsearch by scripted aggregation. But I don't know how to define such in Kibana.
Any ideas on how to do it would be very welcome! Comments explaining that it's impossible to do it would be also valuable.
Kibana 4 includes support for Elasticsearch scripting. You can go to Settings > Indices (pick your pattern) > Scripted Fields and add a new scripted field that computes your CTR. Take a look at "Scripted Fields" at elastic blog for more info.
I had to do something similar for a customer, but couldn't manage to get it done using scripted fields, because I had to sum UP all the values on each aggregation. I ended up developing a custom visualization (Plugin). This was for Kibana 4.1 and 4.5.1.
Let me know if this is what you are looking for, or if you want to give it a go yourself I can give you some pointers.