One of this simplest and most common questions we ask of our many datasets is "show me how this is changing over time, per [insert anything here]"
An example is, show me how the disk free space is changing over time, per server.
So we have 2 aggregations: a date histogram and a terms aggregation.
The single metric is the average free space.
In a Kibana4 table visualization, you'll end up with something like this:
| timestamp per day |
Top 3 servername.raw |
Average free_space_gb |
| April 15th, 2015 |
server1 |
12.321 |
| April 15th, 2015 |
server2 |
17.552 |
| April 15th, 2015 |
server3 |
22.359 |
| April 16th, 2015 |
server1 |
13.523 |
| April 16th, 2015 |
server2 |
16.127 |
| April 16th, 2015 |
server3 |
19.245 |
This is not how I think a user expects to see this kind of data. Since there are only 2 aggregations, this data could be displayed as a simple grid with time on the Y and Server on the X (or vice versa).
Average servername.raw free_space_gb
| timestamp per day |
server1 |
server 2 |
server3 |
| April 15th, 2015 |
12.321 |
17.552 |
22.359 |
| April 16th, 2015 |
13.523 |
16.127 |
19.245 |
I understand that this will only work with 2 aggregations and a single metric, but it greatly improves the UX (especially when many terms are returned). All a user has to do is find the intersection of the two things they are looking for, and they have the value they want.
One of this simplest and most common questions we ask of our many datasets is "show me how this is changing over time, per [insert anything here]"
An example is, show me how the disk free space is changing over time, per server.
So we have 2 aggregations: a date histogram and a terms aggregation.
The single metric is the average free space.
In a Kibana4 table visualization, you'll end up with something like this:
This is not how I think a user expects to see this kind of data. Since there are only 2 aggregations, this data could be displayed as a simple grid with time on the Y and Server on the X (or vice versa).
Average servername.raw free_space_gb
I understand that this will only work with 2 aggregations and a single metric, but it greatly improves the UX (especially when many terms are returned). All a user has to do is find the intersection of the two things they are looking for, and they have the value they want.