I'm new to ELK Stack. I'm working on a Kibana dashboard to find the delta(difference) of count of each day from previous day. So, that we can know how much increase was there in the sales of each day comapared to previous day
For reference : Present Dashboard Wrote a query to find the count for each date and the bucket aggregated with the version number.
My query:
{
"aggs": {
"2": {
"date_histogram": {
"field": "install_date",
"interval": "1d",
"time_zone": "America/New_York",
"min_doc_count": 1
},
"aggs": {
"3": {
"terms": {
"field": "version.keyword",
"size": 50,
"order": {
"_key": "desc"
},
"script": "( _value.indexOf('-') > 0 ? _value.substring(0, _value.indexOf('-')+2) : _value )"
},
"aggs": {
"1": {
"sum_bucket": {
"buckets_path": "1-bucket>_count"
}
},
"1-bucket": {
"date_histogram": {
"field": "install_date",
"interval": "1d",
"time_zone": "America/New_York",
"min_doc_count": 1
}
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "deploy_date_asset_tag",
"format": "date_time"
},
{
"field": "deploy_date_localtime",
"format": "date_time"
},
{
"field": "install_date",
"format": "date_time"
},
{
"field": "timestamp",
"format": "date_time"
},
{
"field": "ui_legacy_access",
"format": "date_time"
},
{
"field": "ui_satori_access",
"format": "date_time"
}
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"range": {
"timestamp": {
"gte": 1408458089497,
"lte": 1566224489497,
"format": "epoch_millis"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}