From a9e4213bef6dd3404af27c615785cf02826c07d0 Mon Sep 17 00:00:00 2001
From: Radu Gheorghe Welcome to timelion the timeseries expression inter
- Why start with elasticsearch? Well, you're using timelion, so we know you have Kibana, so you definitely have Elasticsearch. So the answer is: Because its easy. Timelion want everything to be easy. Ok, lets do this thing. If you're already familar with Timelion's syntax, Jump to the function reference, otherwise click the Next button in the lower right corner. + Why start with elasticsearch? Well, you're using timelion, so we know you have Kibana, so you definitely have Elasticsearch. So the answer is: Because its easy. Timelion want everything to be easy. Ok, let's do this thing. If you're already familar with Timelion's syntax, Jump to the function reference, otherwise click the Next button in the lower right corner.
@@ -84,7 +84,7 @@
- Counting events is all well and good, but the elasticsearch data source also supports any Elasticsearch metric that returns a single value. Min, max, avg, sum and cardinality are some of the most useful. Lets say you want a unique count of the src_ip
field. You could do say, .es(*, metric='cardinality:src_ip')
. To get the average of the bytes field you would run: .es(metric='avg:bytes')
.
+ Counting events is all well and good, but the elasticsearch data source also supports any Elasticsearch metric that returns a single value. Min, max, avg, sum and cardinality are some of the most useful. Let's say you want a unique count of the src_ip
field. You could do say, .es(*, metric='cardinality:src_ip')
. To get the average of the bytes field you would run: .es(metric='avg:bytes')
.