# Can I get the related messages from a Kibana visualization?

**URL:** <https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692>\
**Category:** Kibana\
**Created:** [September 25, 2017, 11:44am UTC](https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692 "2017-09-25T11:44:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dimitry\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dimitry_khan/32/47127_2.png) [@Dimitry\_Khan](https://discuss.elastic.co/u/Dimitry_Khan)\
**Post date:** [September 25, 2017, 11:44am UTC](https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692/1 "2017-09-25T11:44:36Z")

</div>

Wondering if there is a way to get list of the messages (or the JSON documents) related to a Kibana visualization. I understand if I apply the same filter on the "Discover", which is on "Visualization", I can filter the related messages. But I was looking to have more direct user experience like an user clicks on a region of a graph and can get the related messages which formed that region. Is there any way to do it?

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [September 25, 2017, 7:46pm UTC](https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692/2 "2017-09-25T19:46:36Z")

</div>

Not directly, unfortunately. You can click on the visualization to create a filter, and you can pin that filter and take it to discover, which will do what you're asking, but isn't very obvious.

The reason is that visualizations are built using _aggregate_ data, so they don't know what the underlying documents are, they only know the aggregate representation of the information. For example, if you have a bunch of traffic data, and you are looking at bytes over time, the records get bucketed by time and the aggregate of the bytes in that bucket are shown (average, sum, etc.).

In contrast, Discover only works with the raw documents, showing you exactly what you have stored in Elasticsearch. Both documents and aggregations can use filters and queries, which is why you can create a filter in one and use it in the other, but the underlying data is not the same.

---

<div class="post-metadata">

**Author:** ![Dimitry\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dimitry_khan/32/47127_2.png) [@Dimitry\_Khan](https://discuss.elastic.co/u/Dimitry_Khan)\
**Post date:** [September 30, 2017, 1:40pm UTC](https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692/3 "2017-09-30T13:40:17Z")

</div>

Thank you @Joe_Fleming. Pinning will help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2017, 1:40pm UTC](https://discuss.elastic.co/t/can-i-get-the-related-messages-from-a-kibana-visualization/101692/4 "2017-10-28T13:40:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
