# Average number of info logs in a particular time period
**URL:** https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698
**Category:** Kibana
**Created:** [August 2, 2018, 7:27am UTC](https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698 "2018-08-02T07:27:31Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sachinbal](https://discuss.elastic.co/u/sachinbal)
#### Post date: [August 2, 2018, 7:27am UTC](https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698/1 "2018-08-02T07:27:31Z")
Hi,
I would like to know whether it is possible to generate a visualization for the average number of info logs in a particular time period. To be more specific I want to find the average number of info logs which are coming to my system from 6 pm to 9 pm from Monday to Sunday. The report which I want is as follows
Time Mon Tue Wed Thu Fri Sat Sun
6 pm - 9 pm 10 2 5 ........
Thanks
Sachin
---
### Author:  [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [August 6, 2018, 2:35pm UTC](https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698/2 "2018-08-06T14:35:41Z")
So this example query would return the documents between 6 and 9 bucketed by day:
```
GET logstash-0/_search
{
"aggs": {
"by_day": {
"date_histogram": {
"field": "@timestamp",
"interval": "day",
"format": "yyyy-MM-dd"
},
"aggs": {
"between6and9": {
"filter": {
"script": {
"script": {
"source": "int hour = doc['@timestamp'].value.hourOfDay; hour > 17 && hour < 22",
"lang": "painless"
}
}
}
}
}
}
}
}
```
You could save it as a custom query and then create a visualization against it.
---
### Author:  [@sachinbal](https://discuss.elastic.co/u/sachinbal)
#### Post date: [August 7, 2018, 6:38am UTC](https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698/3 "2018-08-07T06:38:12Z")
Hi,
I tried to use this but I am getting the following message.
Error: [parsing\_exception] no [query] registered for [aggs], with { line=1 & col=145 }
at respond ([http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:13:2730](http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:13:2730))
at checkRespForFailure ([http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:13:1959](http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:13:1959))
at [http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:2:341](http://elk.monetago.com/bundles/kibana.bundle.js?v=15629:2:341)
at processQueue ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:38:23621](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:38:23621))
at [http://elk.monetago.com/bundles/commons.bundle.js?v=15629:38:23888](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:38:23888)
at Scope.$eval ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:4619](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:4619))
at Scope.$digest ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:2359](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:2359))
at Scope.$apply ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:5037](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:39:5037))
at done ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:37:25027](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:37:25027))
at completeRequest ([http://elk.monetago.com/bundles/commons.bundle.js?v=15629:37:28702](http://elk.monetago.com/bundles/commons.bundle.js?v=15629:37:28702))
Also I am not sure as to how do I create a custom query? I have entered the query given above in Discover, add a filter. Is this correct or do I need to enter it somewhere else. Please advise
Thanks
Sachin
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2018, 6:38am UTC](https://discuss.elastic.co/t/average-number-of-info-logs-in-a-particular-time-period/142698/4 "2018-09-04T06:38:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.