Update TSVB docs with guidelines on how to group by multiple fields (#103224)

* Update TSVB FAQ section with guidelines on how to group by multiple fields

* Apply text suggestion
This commit is contained in:
Stratoula Kalafateli 2021-06-28 18:13:31 +03:00 committed by GitHub
parent 22d5c90855
commit 8fa4421cac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 0 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 143 KiB

View file

@ -166,3 +166,15 @@ For other types of month over month calculations, use <<timelion, *Timelion*>> o
Calculating the duration between the start and end of an event is unsupported in *TSVB* because *TSVB* requires correlation between different time periods.
*TSVB* requires that the duration is pre-calculated.
[float]
===== How do I group on multiple fields?
To group with multiple fields, create runtime fields in the index pattern you are visualizing.
. Create a runtime field. Refer to <<managing-index-patterns, *Manage index patterns data fields*>> for more information.
+
[role="screenshot"]
image::images/tsvb_group_by_multiple_fields.png[Group by multiple fields]
. Create a new TSVB visualization and group by this field.