Displaying calculated fields in Kibana 4

Question

We are using Kibana 4 to display usage statistics for our tools by tagging log entries with a "stats" flag.

This allows us to show ie tool A was executed 15 times in the last 60 minutes. Now using this tool saves time ie for tool A it saves users 3 minutes.

So I would like to show in another graph how many minutes were saved ie we saved 45 minutes in the last 60 minutes to show the return on investment in realtime for a particular tool.

Is there anyway to do this in ElasticSearch or Kibana (ie have a calculated field which multiplies by a fixed value based on the specific tool)? It would be great if the answer would provide a dynamic way of doing this ie a calculated field rather then adding redundant information to millions of past and future records.

Thanks, Patrick

Answer 1

Kibana 4 supports scripted fields. You can add calculated fields and use them in visualizations. Scripted fields use the Lucene expression syntax.

From Kibana documentation:

You can reference any single value numeric field in your expressions, for example:

doc['field_name'].value To create a scripted field:

1. Go to Settings > Indices
2. Select the index pattern you want to add a scripted field to.
3. Go to the pattern’s Scripted Fields tab.
4. Click Add Scripted Field.
5. Enter a name for the scripted field.
6. Enter the expression that you want to use to compute a value on the fly from your index data.
7. Click Save Scripted Field.

Answer 2

Assuming you are using Kibana 3, you could store the time the tool saves in each log event.

{tool: "A", timeSaved: 3}

And then in Kibana you can use a histogram panel and use "total" for the chart values: