How to calculate and visualize the number of solved issues

Hi,
I have a field in my logfile that is called “last_seen_time”. This field gets populated with a timestamp that describes when a problem was last seen. Once a problem is not seen for two months anymore we consider the problem solved.
How can I best visualize the number of solved issues over time in Kibana in this configuration (only solved if not seen anymore since “that date on the axis - 2 month”?

I want to visualize number of solved issues on y axis, time on x axis.
If possible it would also be nice to express this not in absolute numbers (number of solved issues) but % wise to the total number of issues in the index.
How can I best do this? Timelion? Anything else? What formulla to use in timelion

Hi @Jhanavi,
this does not sound like something that would be easy to solve in Kibana. But maybe we can work something out if you tell me a bit more about your schema:

  • is there a document for each class of issues or for each occurence of an issue
  • how does last_seen_time differ from the primary timestamp field of the document (if there is one)
  • how are the classes of issues identified (some kind of keyword?)
  • There is a document for each occurence of an issue
  • last_seen_time is the time of the last vulnerability scan where the issue was identified, not the time the logline was imported in ELK
  • classes are CVE with an id and description + extra info

I can’t think of a way to achieve that without pre-processing your data. I would recommend to use something like logstash or a custom script to regularly post documents to a separate index that contains the summary of the status you want to visualize. For example you could post a document like

{
  "@timestamp": "1516031776000",
  "open_issues": [
    "CVE-1",
    "CVE-3"
  ],
  "closed_issues": [
    "CVE-2"
  ]
}

every day and easily visualize them using normal Date Histogram, Terms, Filters and Cardinality aggregations.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.