# Bar graph of values in one event

**URL:** <https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663>\
**Category:** Logstash\
**Created:** [November 21, 2016, 3:07am UTC](https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663 "2016-11-21T03:07:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Post date:** [November 21, 2016, 3:07am UTC](https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663/1 "2016-11-21T03:07:35Z")

</div>

I am testing out ELK for specific use case. I have several JSON objects like this:

```
{
  "field1": "uniquevalue1",
  "field2": [
    {
      "field2a": "value2a",
      "time": <sometimestampvalue>
    },
    {
      "field2b": "value2b",
      "time": <sometimestampvalue>
    },
    ...
  ]
}

```

I want to take each object like this into Kibana as a single event. `field1` contains unique value which can identify an event. After searching by `field1`, or in other words, after finding specific event, I want to make a visualization(bar chart) in Kibana on `field2` values. `time` on X-axis and `field2b` on Y-axis. Is it possible to create visualization based on values inside an array?

If I apply "split filter" on `field2` in Logstash, I can create multiple events, and that could help in creating the above mentioned visualization easier. But, I do not want to create 1 event per 1 array element of `field2`. I want 1 event to contain entire `field2` array. So, is it possible without split filter in Logstash?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 21, 2016, 6:01am UTC](https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663/2 "2016-11-21T06:01:13Z")

</div>

Kibana does not support this type of nested events, so I believe you will need to split it up in Logstash in order to visualise it the way you describe.

---

<div class="post-metadata">

**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Post date:** [November 23, 2016, 1:44am UTC](https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663/3 "2016-11-23T01:44:58Z")

</div>

Thanks for the quick response. I have a use case where I have to generate one event per object above. If I create multiple events by using "split filter" in Logstash, then per each object above, multiple events will be created. That I am trying to stop.

If I use "split filter", then say multiple events are created. In that case, is it possible to show Discover tab results in this fashion below?

## field1:uniquevalue1 (header)

`field2.field2a:xxx, field2.time:1478511000000` (event)  
`field2.field2a:yyy, field2.time:1478512000000` (event)  
`....`

## field1:uniquevalue2 (header)

`field2.field2a:zzz, field2.time:1478513000000` (event)  
`field2.field2a:xyz, field2.time:1478514000000` (event)  
`....`

In other words, for each object in my question, I need to display `field1`(which is unique) **only once- something like a header**. That should be followed by all the events generated because of split filter on `field2`. Is this structure possible in Kibana?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2016, 1:45am UTC](https://discuss.elastic.co/t/bar-graph-of-values-in-one-event/66663/4 "2016-12-21T01:45:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.