Timelion: Allow math operations on inner join of different splits, or allow to define split values

[Ido-PX]

Describe the feature:
I'm trying to divide two split series.
Splitting by same term & same number of splits in each series.
The query is a bit different for each series - this causes the splits to be different which then don't match.

The error given by timelion:
Timelion Error: in cell #1: Unable to pairwise reduce seriesLists, number of series are not the same
Possible solutions:

1. Allow specifying an array of the split values so they match in each case.
2. Do some kind of join on the splits, so that even though they don't match, I can take the account_name values in the numerator or the denomenator or inner or outer join etc.
3. Allow splits after operations and functions, then I can split the result of the division.

Any of these solutions would work for me, but I wasn't able to find a way to do any of them.

Describe a specific use case for the feature:

An example query is as follows:
.es(q = 'TR:CR AND CV:true', split = account_name:10).divide(.es(q = 'TR:CR AND AT:B', split = account_name:10))

account_name potentially has hundreds of values.
The only way to do this now (that I know of) is to run each series, see which accounts are returned, then choose 10 accounts and write 10 individual queries.

[elasticmachine]

Pinging @elastic/kibana-app

[andykais]

A (conceptually) simple fix for this problem would be specifying that the split is not a max number of buckets, but exactly how many buckets are required.

E.g.

.es(
  q='TR:CR AND CV:true',
  split_exact=account_name:10
).divide(.es(
  q='TR:CR AND AT:B',
  split_exact=account_name:10
))

split -> split_exact, which ensures exactly 10 buckets are created.

whichever query has more splits can look to the other for a NULL split in addition to a matching split

[Ranakel]

+1

[richievos]

I personally think a straightforward solution to this is just let me specify a default value. Eg, if I'm trying to divide X / Y, if there's not a value for X, let me default it to 0. Whether I do that by doing .divide(default=0 or I do .default(.es(X), 0).divide(.default(Y, 1)) I don't care much about.

[deng1028]

+1

[asemeniuc23]

I personally think a straightforward solution to this is just let me specify a default value. Eg, if I'm trying to divide X / Y, if there's not a value for X, let me default it to 0. Whether I do that by doing .divide(default=0 or I do .default(.es(X), 0).divide(.default(Y, 1)) I don't care much about.

Any idea how to get .default() function in ELK 7? It seems it doesn't come with the default function suite.

[Foorth]

+1

[KOSSOKO]

4 years later, still no solution ?

[Angad11]

Hey Team,
No one solution works in this case, I think It is very important to give support for default values in above case or please give any alternate solution.

[timductive]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.