Post this (but replace windowbucket and afkbucket with your own bucketnames) to 127.0.0.1:5600/api/0/views/myview
{
"name": "myview_active",
"query": {
'chunk': 'app',
'cache': true,
'transforms':
[{
'bucket': windowbucket,
'filters':
[{
'name': 'timeperiod_intersect',
'transforms': [{
'bucket': afkbucket,
'filters': [{
'name': 'include_keyvals',
'key': 'status',
'vals': ['not-afk'],
}]
}]
}]
}]
}
}
After that you can use a get request on 127.0.0.1:5600/api/0/views/myview?start=2017-12-11&end=2017-12-18 to get a JSON summary of all events last week.
If you only want total active/afk time, I think this query should work instead
POST 127.0.0.1:5600/api/0/views/myview_active
{
"name": "myview_active",
"query": {
"chunk": "status",
"cache": true,
"transforms": [{
"bucket": afkbucket
}]
}
}
GET 127.0.0.1:5600/api/0/views/myview_active?start=2017-12-11&end=2017-12-18