# Aggregate multiple records to single chart

**URL:** <https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561>\
**Category:** Kibana\
**Created:** [May 21, 2017, 9:56am UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561 "2017-05-21T09:56:14Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![avivc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avivc/32/16501_2.png) [@avivc](https://discuss.elastic.co/u/avivc)\
**Post date:** [July 2, 2017, 6:36am UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/21 "2017-07-02T06:36:26Z")

</div>

Hi @LeeDr  
Yes I'm trying to set my\_index mapping docs after it indexed.  
Regarding the deletion - if I remove this docs, how can I map data that is not exist?

**There's no problem to delete it, I can restore it easliy**

10x in advance

---

<div class="post-metadata">

**Author:** ![avivc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avivc/32/16501_2.png) [@avivc](https://discuss.elastic.co/u/avivc)\
**Post date:** [July 26, 2017, 3:58pm UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/22 "2017-07-26T15:58:22Z")

</div>

Hi @LeeDr  
Any idea?  
Tnx

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [July 27, 2017, 7:13pm UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/23 "2017-07-27T19:13:09Z")

</div>

Hi Avivc,

You still haven't posted example data such that I can understand your question, so I'm making some up. In the Dev Console I did this;

```auto
POST my_index/defect/
{
      "Project._refObjectName": "value1"
}

POST my_index/defect/
{
      "Project._refObjectName": "value2"
}

POST my_index/defect/
{
      "Project._refObjectName": "value3"
}

POST my_index/defect/
{
      "Project._refObjectName": "value4"
}

POST my_index/defect/
{
      "Project._refObjectName": "value5"
}

POST my_index/defect/
{
      "Project._refObjectName": "value1"
}

POST my_index/defect/
{
      "Project._refObjectName": "value2"
}

```

Then I made this scripted field named `oneOrTwo`;

```auto
if (doc['Project._refObjectName.keyword'].value == 'value1' || doc['Project._refObjectName.keyword'].value == 'value2') {
return "value1or2";
} else {
return doc['Project._refObjectName.keyword'].value
}

```

And then I made this visualization which shows a terms aggregation on that scripted field. Since there are 2 docs with `value1` and 2 docs with `value2` the chart shows a count of 4 docs with the value of `value1or2`;

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53353129f179c534ec29c3f8bc56045b0286acbd.png)

I can also create the same chart without using the scripted field by using a Filter aggregation (the first filter is `Project._refObjectName.keyword=value1 OR Project._refObjectName.keyword=value2`

 ![](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1dfbbdb6c494ebf34fcaaf66cb82a97461067b6.png)

---

<div class="post-metadata">

**Author:** ![avivc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avivc/32/16501_2.png) [@avivc](https://discuss.elastic.co/u/avivc)\
**Post date:** [August 8, 2017, 7:33am UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/24 "2017-08-08T07:33:57Z")

</div>

Hi @LeeDr

> [@LeeDr](#):
>
> And then I made this visualization which shows a terms aggregation on that scripted field. Since there are 2 docs with value1 and 2 docs with value2 the chart shows a count of 4 docs with the value of value1or2;

I've tried that before - it causing an error that related to unsupported files  
But the 2nd option works great ! I think for now it's good enough for me.  
I'll share some code and the error I'm getting for other developers too

Thank you very much ✌👌

**BTW** : using filtering in visualize exist from which version ?

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [August 8, 2017, 4:49pm UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/25 "2017-08-08T16:49:12Z")

</div>

I see the Filter aggregation being available as far back as 4.6.5 version of Kibana, probably earlier than that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2017, 4:49pm UTC](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/26 "2017-09-05T16:49:16Z")

</div>

Closed on September 5, 2017, 4:49pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561.md?page=1)