Kibana Timelion插件如何在弹性搜索中指定一个字段 [英] Kibana Timelion plugin how to specify a field in the elastic search

问题描述

我正在尝试使用 Timelion 插件进行kibana。

I'm trying to use Timelion plugin for kibana.

我在弹性搜索中有一个数据集，结构可能是这样的：

I have a dataset in the elasticsearch, the structure may be like this:

{
    "_index": "metrics-2016-03",
    "_type": "gauge",
    "_id": "AVM2O7gbLYPaOnNTBgG0",
    "_score": 1,
    "_source": {
        "name": "kafka.network.RequestChannel.ResponseQueueSize",
        "@timestamp": "2016-03-02T07:29:56.000+0000",
        "value": 4,
        "host": "localhost"
    }
}

我想将value字段显示为y轴，@时间戳作为x aixs，该怎么办？

I want to show the "value" field as the y axis and "@timestamp" as the x aixs, how should I do?

我尝试过 .es（）函数，但这个函数似乎将count设置为默认值，而不是数据源中的value字段。

I tried the .es() function, but this function seems to set the count as the default value, not the "value" field in the datasource.

推荐答案

Timelion为其时间图使用预定义的时间间隔。
为了绘制值作为时间的函数，您可以将粒度设置为自动，并使用此字符串：

Timelion uses pre-defined time intervals for its time plots. In order to plot the "value" as function of time you can set the granularity to 'Auto' and use this string:

 .es(metric='max:value')

您还可以设置粒度到最小可能，并将 .fit（carry）添加到上述字符串中，以填充null值，在这种情况下，您可以替换 max 与 min 或 avg ，它将产生相同的情节（ sum 不会在这里工作）。

You can also set the granularity to the minimum possible and add .fit(carry) to the above string in order to fill null values, in that case you can replace max with min or avg, it will produce the same plot (sum won't work here).

这篇关于Kibana Timelion插件如何在弹性搜索中指定一个字段的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！