anelson-vidscale

Elasticsearch query

          "aggs": {
            "by_site": {
              "terms": {
                "field": "site",
                "size": 500
              },
              "aggs": {
                "by_top_hits" : {

anelson-vidscale

 "aggregations" : {
    "by-key" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "storage",
          "doc_count" : 3,
          "my-toppest" : {
            "hits" : {

anelson-vidscale

POST /ledger/_search?size=0
{
"size" : 0,
 "aggs": {
   "by-key": {
     "terms": {  "field": "alert_key",   "size": 10   },
     "aggs": {
       "firing-only"    : { "filter":  { "term": { "state": "fire" } } ,    "aggs": { "max-firing-only":  { "max": { "field": "@timestamp"  } }   } },
       "resolve-only"   : { "filter" : { "term": { "state" : "resolve" } }, "aggs": { "max-resolve-only": { "max": { "field": "@timestamp"  } }   } },
       "my-decorations"  : { "bucket_selector": { 

anelson-vidscale

PUT /ledger/log/_bulk?refresh
{"index":{"_id":1}}
{"alert_key": "storage","severity": "critical", "@timestamp" : "2019-11-01T06:04:10.000000+00:00", "start_epoch" : 1572588250, "jira" : "OST-1", "state" : "fire"}
{"index":{"_id":2}}
{"alert_key": "cpu","severity": "high",         "@timestamp" : "2019-11-01T06:04:10.000000+00:00", "start_epoch" : 1572588250, "jira" : "OST-2", "state" : "fire"}
{"index":{"_id":3}} 
{"alert_key": "memory","severity": "medium",    "@timestamp" : "2019-11-01T06:04:10.000000+00:00", "start_epoch" : 1572588250, "jira" : "OST-3", "state" : "fire"}
{"index":{"_id":4}}
{"alert_key": "disk","severity": "low",         "@timestamp" : "2019-11-01T06:04:10.000000+00:00", "start_epoch" : 1572588250, "jira" : "OST-4", "state" : "fire"}
{"index":{"_id":5}}

anelson-vidscale

{
  "$schema": "https://vega.github.io/schema/vega/v3.json",
  "autosize": "pad",

  "signals": [
    {  "name": "my_height", "value": 200 },
    {  "name": "my_width", "value": 200 },
      
   {
      "name": "startAngle", "value": 0,

anelson-vidscale

{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "width": 200,
  "height": 200,
  "autosize": "none",

  "signals": [
    {
      "name": "startAngle", "value": 0,
      "bind": {"input": "range", "min": 0, "max": 6.29, "step": 0.01}

anelson-vidscale

{
  "$schema": "https://vega.github.io/schema/vega/v3.json",
  "width": 300,
  "height": 240,
  "padding": 5,

  "data": [
    {
      "name": "table",
      "values": [

anelson-vidscale

I am now trying to help you help me by giving you the commands to create the data in elasticsearch
so that we are talking about the same thing.

DELETE alerts

POST _bulk?refresh
{ "index" : { "_index" : "alerts", "_id" : "1", "_type" : "log" } }
{ "name" : "storage_controller_failure" }
{ "index" : { "_index" : "alerts", "_id" : "2", "_type" : "log" } }
{ "name" : "storage_controller_failure" }

anelson-vidscale

/*
 *   The only difference is that the name of the array is "buckets" instead of "values"
 *   When the name is "values" it works. 
 *   When the name is "buckets" it does not.
 *   I need to tell the "domain" to use "buckets" not "values", but I could not figure out how.
 */
 
{
  "$schema":"https://vega.github.io/schema/vega/v3.json",
  "width": 400, "height": 100,