0

I have data being written to Elasticsearch that I wanted to visualize in Kibana, but I'm having problems with the visualization.

I have a process writing when it starts {ProcessStartTime} and when it stops {ProcessStopTime}

I'm trying to create what I thought was a simple visualization:

A vertical bar chart with Count as the Y-Axis and {ProcessStartTime} and {ProcessStopTime} as bars on the X-Axis.

The problem is, instead of count of 480 for the {ProcessStartTime} as one vertical bar and a count for 389 for {ProcessStopTime} as another vertical bar. It separates out all unique {ProcessStartTime} entires so I have a count of 1 with a thousand vertical bars. Moreover, I appears I cannot add more than one term, just sub categories, so {ProcessStopTime} isn't on the bar chart at all. So I decided to try the Filter aggregation, which allowed me to get a count of all entries with "ProcessStartTime" in the body. However, I cannot add "ProcessStopTime" as another filter as those don't coexist.

My current solution is to have two charts, using the Filter aggregation, then compare the charts side-by-side to compare the counts. For obvious reasons, I'd like those combined, but I just don't see how to have two X-Axis buckets, or to group the data as it needs to be.

I am missing something obvious?

1 Answer 1

1

I might get wrong what you are trying to do and I can't comment on your question to ask for details, but here are a few things that you can do:

Get all entries regardless of their content (empty search query). Keep the Y-axis metrics for Aggregation-Count. After that you can set a bucket for the X-axis with Filters aggregation, and use 2 filters.
Filter 1: ProcessStartTime: *
Filter 2: ProcessStopTime: *
This setup should give you 2 bars with the count of records that have the given attributes.

The other option is to make a new attribute, for example 'event', and give this attribute the values 'ProcessStartTime' and 'ProcessStopTime', and make a Terms aggregation bucket setup on event.keyword.

I hope this helps.

1
  • Thank you. I had a couple issues. First, I didn't have the ":*" after the filters. Second, I needed to prefix "fields." before the filter, otherwise it wasn't checking the indexed field. Jan 10, 2018 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.