# Attempting to Visualize Max Concurrent Users **URL:** \ **Category:** Kibana\ **Created:** [March 9, 2018, 7:00am UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208 "2018-03-09T07:00:15Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rohus24](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@rohus24](https://discuss.elastic.co/u/rohus24)\ **Post date:** [March 9, 2018, 7:00am UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208/1 "2018-03-09T07:00:16Z")
Hello, I'm currently trying to visualize max concurrent users from my application. There exists a separate log file for this purpose with the following nomenclature: 09-Mar-2018 12:24:31,0 09-Mar-2018 12:25:31,0 09-Mar-2018 12:26:31,1 Here, the initial two fields are the date & time stamps followed by an integer value for the concurrent users. I'm getting this data from Filebeat and am able to see it in Kibana. However, when attempting to create a visualization, the available metrics (count/average etc.) cannot be used here. Data is received from logstash with the concurrent user value as a separate field. A filter with this field (exists) is applied on the visualization page. Idea is to capture the concurrent users value on the Y-axis with a hourly histogram on the X-axis. Any inputs would be appreciated. Thanks in advance! ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 12, 2018, 12:07pm UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208/2 "2018-03-12T12:07:20Z")
Hey @rohus24 it sounds like you don't have the concurrent users in a separate field in Elasticsearch, is this correct? You'll want to use [Logstash](https://www.elastic.co/guide/en/logstash/current/index.html) or the [Elasticsearch Ingest Node](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/ingest.html) to parse the single line of text into separate fields, and then you can create your Kibana Visualizations, etc. ---
**Author:** ![rohus24](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@rohus24](https://discuss.elastic.co/u/rohus24)\ **Post date:** [March 13, 2018, 4:51am UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208/3 "2018-03-13T04:51:57Z")
Hi Brandon, thanks for your reply. I do have the concurrent users parsed and stored as a separate field in Elasticsearch via Logstash. What aggregation should I choose when making the visualization? The count aggregation for example shall literally count the instances of the field reported for preparing the graph. I would like to use the literal value denoted by the last column in the logs (e.g. 0 followed by 0 followed by 1 the next minute) for plotting the graph. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 13, 2018, 11:54am UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208/4 "2018-03-13T11:54:47Z")
@rohus24 Ah, gotcha. As you're probably aware, the Kibana Visualizations are all based off of aggregations against Elasticsearch and not the raw values. I assume the concurrent users field is a snapshot of the number of concurrent users at that specific point in time, and this fluctuates throughout the hour, but you're looking for a single data-point to display to end-users. In this situation, using the Max aggregation of the concurrent users seems to be the closest to what you're looking for. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 10, 2018, 11:54am UTC](https://discuss.elastic.co/t/attempting-to-visualize-max-concurrent-users/123208/5 "2018-04-10T11:54:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.