# Breakdown of Time Entry

**URL:** <https://discuss.elastic.co/t/breakdown-of-time-entry/165444>\
**Category:** Kibana\
**Created:** [January 23, 2019, 3:55pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444 "2019-01-23T15:55:01Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![schoffelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/schoffelman/32/18461_2.png) [@schoffelman](https://discuss.elastic.co/u/schoffelman)\
**Post date:** [January 23, 2019, 3:55pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/1 "2019-01-23T15:55:01Z")

</div>

I'm working on project where I have time sheet entries from every employee. Every doc includes the amount logged, their name, and a category id. From those category id's we section it into 3 major groupings.

Does anyone have any ideas on graphing out on a weekly or monthly basis what the company average is from the average of each employee, based off of those three major categories?

If it was a bar graph, I'd love to have the X axis the date (weekly if possible), the Y axis those three categories, and then the bar itself divided among those three main categories.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 24, 2019, 11:56pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/2 "2019-01-24T23:56:10Z")

</div>

Having a bunch of averages, and taking the average of those unfortunately does not give you meaningful data. That is because averages are only comparable to each other if they are based on the same denominator.

Is an average of 6 "more" than an average of 5? If the average of 6 came from `[12, 0]` and the average of 5 came from 8 million records that were all 5s, is the 6 still higher? You have to know more about how those initial averages were calculated. In this case, one of the avgs was calculated with 2 as the denominator and the other was 8 million.

That's an extreme difference example, but I hope it shows the point: if on the one hand, 2 things happened and on the other hand, 8 million things happened, just knowing that some numbers came out which were 6 and 5 is a complete disconnect.

I'd say a way to come up with some useful information where the integrity of the information is the same would be to come up with a way to normalize an average of something you're interested in (multiply the numerators so the denominator can be the same), add up all the numerators and divide that by the common denominator. That gives you a normalized average, and that is what you would want the visualization to be working off of.

---

<div class="post-metadata">

**Author:** ![schoffelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/schoffelman/32/18461_2.png) [@schoffelman](https://discuss.elastic.co/u/schoffelman)\
**Post date:** [January 25, 2019, 2:24pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/3 "2019-01-25T14:24:23Z")

</div>

Good point Tim. I got so focused on the how, that I completely forgot to take a step back and see that my math was off. Thank you for the suggestions.

The larger point I probably failed at communicating was a way to see the companies averages within these categories based on a timeline. Thank you for your suggestions.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 25, 2019, 10:09pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/4 "2019-01-25T22:09:26Z")

</div>

Hi, I got to thinking, maybe it would help to see this data as a bar chart with a date histogram (maybe 1 week interval), with split series. The Y-axis is the overall average of amount. Now, split the bar by terms, which can be employee name or category ID.

I have some sample data log I can use to illustrate it, where the documents have "partition", "metric" , and "success" fields. Example document:

```auto
{
  "_index": "partitions",
  "_type": "doc",
  "_id": "xrxHg2gBmskfQiRIKwuQ",
  "_version": 1,
  "_score": null,
  "_source": {
    "@date": "2019-01-25T04:30:45Z",
    "partition": "/private/var/vm",
    "metric": 6852,
    "success": false
  },
  "fields": {
    "@date": [
      "2019-01-25T04:30:45.000Z"
    ]
  },
  "sort": [
    1548390645000
  ]
}

```

Without splitting any series, I can get an overall average of "metric" per week:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84d4ba9c47bc4ba9feb385912d3d45a8a0713623.png)

Now I can split the series on a terms aggregation and use "partition" as the field to split by. Now I have average per partition per week, for each of the top 5 partitions of each week:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e501c89d56def9cd5f7a476cc3aa99b85b090d8.png)

I can also break it down further and aggregate by the `success` true/false values. But at this point I don't want to add another aggregation that will segment these bars, because I'd end up with the same partitions showing twice in a bar. Instead, I want to split the entire chart into 2 charts and have 1 for `success:true` and `for`success:false`.

Here's my Data tab now:  
 ![data](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5a16314a6b3aae60322160a43b52756d9c947ed.png)

If I change some options in "Metrics & Axes" I can make the chart type as "area", the line mode as "smooth" and the mode as "wiggle". Why all that stuff? It kind of allows me to make a chart similar to the famous "Ebb and Flow of Movies" chart: [https://archive.nytimes.com/screenshots/www.nytimes.com/interactive/2008/02/23/movies/20080223\_REVENUE\_GRAPHIC.jpg](https://archive.nytimes.com/screenshots/www.nytimes.com/interactive/2008/02/23/movies/20080223_REVENUE_GRAPHIC.jpg)

Now here's the chart:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/977de9d829d4fdabecb082cc44f74741ce73f8be.png)

I split the data up by `success` which gives me 2 charts because a boolean can have one of 2 values. The top one is labeled `1: success: Descending` so that's an aggregation of the data where `success:true` If I used a filters aggregation instead of a terms aggregation for `success`, that aggregation in the editor would look like this:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f5244ccea0454fd56a9b923f8b8116787d84a65.png)

And now my legends look like this:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed159d4dba97693d2163864905bbf9578f74b5f4.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b8dce33e8072f1beebacf8465559bcaab035f214.png)

If this is starting to look good, I'd urge you to keep looking at other tools in Kibana such as Visual Builder, Timelion, and Canvas: those can each do the same kinds of aggregations I've shown you but offer different options on customizing the presentation.

The idea here is to have the averages split by employee (what I did with `partition`), and then the charts split by category (what I did with `success`).

---

<div class="post-metadata">

**Author:** ![schoffelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/schoffelman/32/18461_2.png) [@schoffelman](https://discuss.elastic.co/u/schoffelman)\
**Post date:** [January 25, 2019, 10:47pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/5 "2019-01-25T22:47:55Z")

</div>

Thanks @tsullivan - I took your suggestions and was able to get it figured out. Here's some screenshots with a few variations, but not many. I'm still working on the wiggle area chart, but the bar chart is primarily what I'm looking for.

Now if we can get the metrics for the bar chart area to display in the bar, that would be awesome. Although, I know that's harder to implement than a pie chart b/c of the history timestamp on the X axis getting really long.

Data:  
 ![data](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35a4fe5dffa17302956853c6f12fa9ef0afba616.png)

Bucket Breakdown:

 ![buckets](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e38b992bbe1d84b28a37b4993932ce9f4d1e35e.png)

And finally, the graph:

 ![graph](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97422b81b27c7961a08b64bfcf0b4a4ef9181dd0.png)

---

<div class="post-metadata">

**Author:** ![schoffelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/schoffelman/32/18461_2.png) [@schoffelman](https://discuss.elastic.co/u/schoffelman)\
**Post date:** [January 25, 2019, 10:50pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/6 "2019-01-25T22:50:17Z")

</div>

Also, here it is with all three main categories.

 ![full-graph](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8b1c468d7f86401de8c2fb8a1ee0c7f3add93132.png)

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 25, 2019, 11:30pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/7 "2019-01-25T23:30:05Z")

</div>

> [@schoffelman](#):
>
> Now if we can get the metrics for the bar chart area to display in the bar, that would be awesome

I'm not entirely sure how you envision that. Here's where exploring other visualization types could be handy though. Take a look at this Canvas workpad: [But First, Coffee... (An Elasticon Canvas Story) | Elastic Blog](https://www.elastic.co/blog/elasticon-kibana-canvas-story-elasticoffee)

We have the different types of coffee, or "categories" with a metric attributed to each, which is total. Then for each type, there is also a sparkline, AKA date histogram.

---

<div class="post-metadata">

**Author:** ![schoffelman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/schoffelman/32/18461_2.png) [@schoffelman](https://discuss.elastic.co/u/schoffelman)\
**Post date:** [January 28, 2019, 3:59pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/8 "2019-01-28T15:59:22Z")

</div>

Thanks @tsullivan - i did think about using Canvas eventually, once all the visualizations are done.

And for sake of conversation, here's an example graph with the number values hovering over the bar.

 ![full-graph-with-labels](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7265fa81f6ef44c1933769bc52ffb4a0a360a07.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2019, 3:59pm UTC](https://discuss.elastic.co/t/breakdown-of-time-entry/165444/9 "2019-02-25T15:59:22Z")

</div>

Closed on February 25, 2019, 3:59pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.