What you will learn in this TP
- Aggregate with STATS
- Calculate with EVAL
- Bucket time with BUCKET
Introduction #
What you will learn in this section
- Aggregate with STATS
- Calculate with EVAL
- Bucket time with BUCKET
Context. The technical lead wants to know which hosts serve the most errors, at what times, and what share of the traffic comes from bots. You answer with ES|QL.
Prerequisites: previous lab completed · Estimated time: 35 min
Complete analyses in a single query.Setup #
Guided steps, with their solutions.
1. First query
Why? ES|QL reads from top to bottom: source, filter, aggregation, sort.
Switch Discover to ES|QL mode and count the requests by source country.2. Errors per host
Why? The
Calculate the number and rate of errors (codes ≥ 500) per host.responsefield is text: convert it in order to compare.3. Hourly profile
Why? Spotting peak hours helps plan maintenance windows.
Count the requests per one-hour bucket over the last 7 days and display the result as a chart.4. Volume served per extension
Why? EVAL lets you convert units on the fly.
Calculate the total volume served in megabytes per file extension.
Difficulty level : ●●●○○ (3/5)
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Exploring data in Discover: KQL, Lucene and ES|QL
Search and analyze logs in Kibana Discover: filters, KQL, Lucene syntax, and the ES|QL language t...
Kibana Maps and Canvas: geographic maps and presentations
Build maps with Kibana Maps (document, aggregation and choropleth layers, ES|QL) and dynamic pres...
Visualizing in Kibana: Lens, dashboards and saved objects
Build visualizations with Lens, assemble interactive dashboards (filters, controls, links), and m...
Elasticsearch mappings and text analysis: field types, analyzers and dynamic mapping
Master Elasticsearch mappings: field types (text, keyword, numeric, date, ip, nested), multi-fiel...
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencer...
Advanced Elasticsearch Query DSL and aggregations, with ES|QL
Write advanced Elasticsearch queries: bool, filter and score, nested, function_score and BM25 rel...
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, thresh...
Elastic path project: centralising and using logs
The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, El...
Elastic Observability: logs, infrastructure, APM and synthetics
Elastic Observability features: log exploration, infrastructure inventory with Elastic Agent and ...