Kibana Training - IDESTRAININGS

It is very crucial to realize aggregations when using kibana they are the basis of all visualizations we will do in kibana training. Kibana Histogram works on data that we have stored in elastic search. Listing search stores documents. Documents may be events from our log files may be tweets our indexing or any other form of JSON documents.

There are two different types of aggregations

1.Bucket aggregations

• Bucket aggregations are responsible for grouping documents so called as Buckets. Each Bucket contains several documents or also just a single document. Depending on the concrete type of Bucket aggregation Bucket might overlap itself and one document may fall in to two or more Buckets and also depending on the type of the bucket aggregation there can be empty buckets and that does not contains empty documents at all.
• After the bucket aggregation has created its buckets they might also be documents that are not part of any bucket. The results of the bucket aggregation are several buckets which can contain several documents. Some of the bucket aggregations are   

1.Histogram:

It works on any field that is type number. Histogram aggregation has numeric setting called interval that you can control histogram aggregation.

2.Date histogram:

It requires to specify an interval in this case you tell it to group each millisecond, each minutes and each seconds. There is an auto interval which will cause kibana to determine what a good time range would for each bucket so that you will get a reasonable amount of buckets as a result.

3.Range:

It works on the numeric field and a date range aggregation for date fields and an IP range that work on fields containing IP addresses.

4. Filter:

It specifies any amount of custom filters each filter is a regular query that you could enter also in the search field in cabana the aggregation will create one bucket for each filter and all the documents matching this filter will be the part of that bucket.

5. Geohash:

It works on the field of type Geo point it will group all documents that are within a specific area together in to one bucket. You can adjust precision which will control how large the area of each bucket will be.

6.Terms:

It works on lot of different types of fields it will create a bucket for the terms in that field that appears the most often and will insert all documents that hit the term with in that field. Since terms highly depending on the mapping configured in elastic search.  

2.Metric aggregations

• Metric aggregation is responsible for calculating a value for each bucket based on the documents inside this bucket Here we link these aggregations to visualizations in kibana training for example the bucket aggregation we have choose has created three buckets.
• Metric aggregation has afterwards calculated these values for the buckets they are 6, 2 and 4 we just realize that like a pie chart each bucket will be one slice of the pie and the size of each slice will be determined by the value of the metric aggregation each bucket slice is as large as the value of this bucket was in this example one part of the pie get two of twelve parts of the pie and the second part gets four of twelve parts and the third one is six of twelve.
• Elastic search in kibana support several different types of bucket and metric aggregations. Elastic search also support some aggregations that have not made it in kibana training.It also works on different types of metric aggregations

1. Count:

Count is not technically a metric aggregation but information that the bucket aggregation automatically outputs but it handled the same way in kibana training as every metric aggregation and the value of each bucket will just be the count of documents in bucket for example 4 and 3 except count aggregation every metric aggregation again requires a field to work.

2.Sum:

Sum aggregation would just sum up all of all values of all documents inside the bucket.

3.Average:

Average matrix aggregation calculates the average of all the values.

4.Median:

Median aggregation will calculate the median.

5.Min:

The Min aggregation also works on date fields and it will return the lowest value or the earliest of any document within that bucket.

6.Max:

Max aggregation works also on date fields and does exactly the opposite it returns the highest value or later state with in the bucket as a value for that bucket.

7.Unique count:

Unique count aggregation outputs the count of distinct values of all documents. Up to now every metric calculated exactly one value for each bucket that’s why they are called single value metric aggregations.

8.Standard deviation:

Standard deviation aggregation is the first multi value aggregation it outputs more than one value per bucket the way this is visualized in kibana training depends on the visualization type for example the bar chart can split the bar it generates for each bucket according to the multiple values the multi value aggregation calculated not all visualizations therefore can handle multi value aggregations. The Standard deviations calculates the lower and upper bounds of the standard deviation as a result for each bucket.

9.Percentiles:

Percentiles aggregation is also multi value metric aggregation here we must specify multiple presenters as an input value it will then find the value for each of the percentages so that amount of documents with in the bucket have a value equal or less to the result.

10.Percentile ranks:

It is basically the reverse of the percentile aggregation in this we can specify the value and we can get the percentage of how many documents are lying under that value.

Our trainers will provide best Kibana training with real time examples. For more details about this module please register with our website.