# Aggregate docs to present a single constructed visualization

**URL:** <https://discuss.elastic.co/t/aggregate-docs-to-present-a-single-constructed-visualization/130683>\
**Category:** Kibana\
**Created:** [May 4, 2018, 8:28pm UTC](https://discuss.elastic.co/t/aggregate-docs-to-present-a-single-constructed-visualization/130683 "2018-05-04T20:28:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![brandondash](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@brandondash](https://discuss.elastic.co/u/brandondash)\
**Post date:** [May 4, 2018, 8:28pm UTC](https://discuss.elastic.co/t/aggregate-docs-to-present-a-single-constructed-visualization/130683/1 "2018-05-04T20:28:16Z")

</div>

I'm reading in a log that records meeting metadata. It has all sorts of stuff, but I only care about two things. Something like this:

> 2018-05-04 14:50:01 eventType=MeetingStartedEvent meetingID=1234 eventTime=14:48:00  
> 2018-05-04 14:56:45 eventType=MeetingEndedEvent meetingID=1234 eventTime=14:49:37

So I've constructed a query that grabs only the data I need:

> eventType:"MeetingStartedEvent" OR eventType:"MeetingEndedEvent"

The only thing that seems like it might work is Data Table. My metric is useless, but at least I can use term aggregation to get buckets of 2 items each based on the meetingID. Problem is now I have no idea how to get from there to a unified presentation of the data. Something like this:

> MeetingID StartTime EndTime

I've read up on scripted indexes and that doesn't seem like it will solve my problem. Is this even possible?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [May 7, 2018, 2:24pm UTC](https://discuss.elastic.co/t/aggregate-docs-to-present-a-single-constructed-visualization/130683/2 "2018-05-07T14:24:52Z")

</div>

There is no way to join documents in Elasticsearch. How are the documents getting added to Elasticsearch? Maybe that process could do the join and only write a single document per meeting?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2018, 2:24pm UTC](https://discuss.elastic.co/t/aggregate-docs-to-present-a-single-constructed-visualization/130683/3 "2018-06-04T14:24:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.