# Aggregate multiple rows fields data in single data **URL:** \ **Category:** Kibana\ **Created:** [September 13, 2017, 1:03pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358 "2017-09-13T13:03:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vinay\_garg](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Post date:** [September 13, 2017, 1:03pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/1 "2017-09-13T13:03:22Z")
Hi, Environment: Elasticsearch, Logstash, Kibana(5.6) I have multiple Fields data. Each field is related to JMX. JMX configuration is: "host":"localhost", "port":1099, "url" : "service:jmx:rmi:///jndi/rmi://localhost:1099/karaf-root", "username" : "admin", "password": "admin", "alias" : "JMX", "queries" : [ { "object\_name" : "org.apache.activemq:type=Broker,brokerName=amq,destinationType=Queue,destinationName=\*", "object\_alias" : "ActiveMQ", "attributes" : ["QueueSize","EnqueueCount","DispatchCount","DequeueCount","Name"] } ] } All fields data is properly indexing. As available in screenshot ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dcece6243a73846c7d55bab9f3ad76a47c377f56.png)file:///home/vinay/Pictures/Screenshot%20from%202017-09-13%2018-26-37.png Now each row have different timestamp but each column field are related to each other. So i have to aggregate all these fields (DispatchCount, DequeueCount,EnqueueCount,QueueName) data into single table. Can anyone suggest how can i do it? ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [September 13, 2017, 1:10pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/2 "2017-09-13T13:10:39Z")
i am not sure i completely understand your problem, but you could try to create a table visualization and define the following metrics: - sum of DispatchCount - sum of DequeCount - sum of Enqueue Count - top 5 of QueueName then for split rows select Date Histogram, with appropriate period (minute?) you could also split rows by term, if there is another field that is common to all your rows that you would want to join, like 'host' or sth let me know if this helps ---
**Author:** ![vinay\_garg](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Post date:** [September 13, 2017, 1:19pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/3 "2017-09-13T13:19:44Z")
Hi, I have this data "QueueSize","EnqueueCount","DispatchCount","DequeueCount","Name"". My requirement is to create a Table which can show information in this way: QueueName | QueueSize | EnqueueCount | DispatchCount | DequeueCount MyQueue1 | 100 | 10 | 5 | 5 MyQueue2 | 500 | 10 | 5 | 5 ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [September 13, 2017, 1:32pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/4 "2017-09-13T13:32:01Z")
so just as i described above, but split rows with term aggregation on QueueName field ---
**Author:** ![vinay\_garg](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Post date:** [September 13, 2017, 2:30pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/5 "2017-09-13T14:30:31Z")
I'm using the following metric: Unique count of DispatchCount Unique count of DequeCount Unique count of Enqueue Count I think split will not work because each field are not part of same row. How can i create table "MyQueue1 | 100 | 10 | 5 | 5" ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [September 13, 2017, 4:27pm UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/6 "2017-09-13T16:27:29Z")
i think you shouldn't be using unique count but sum .... but i don't know your data .. so just as i said, split rows by term aggregation on queuename field, add metrics for all the other fields. ---
**Author:** ![vinay\_garg](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Post date:** [September 14, 2017, 6:00am UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/7 "2017-09-14T06:00:43Z")
Let me clear it. We are having original data as mention in below screenshot. One metric\_path having multiple fields(ActiveMQ.ActiveMQ.Name,ActiveMQ.ActiveMQ.Name, etc..). ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe5c4e77239d797b87e05bf89bce93007ce2111a.png) We set different field name for each value by using filters if ("DispatchCount" in [metric\_path] ) { ruby { code =\> "event.set('DispatchCount' , event.get('metric\_value\_number') )" } } We have created fields frm metric\_path as mentioned in screenshot: ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b25d9124106e1d54113f0ac2b3bd34fc11fcef93.png) Each field is behave as different row rather than same row with other fields. Now i have to visualise the multiple row data into single. Split will work that case if we have data only in single row. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 12, 2017, 6:00am UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358/8 "2017-10-12T06:00:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.