Count active docs and display by date in Line Chart

Elastic Stack Kibana
1

Hi,

I have an index with the fields: @timestamp, boolean: active and solved_date (see below).
If I import the values, the solved_date field is not set and the boolean is true.

When I want to make the document inactive I update the solved_date and i set the boolean to false.

What is the best way to create a LineChart that counts the active objects by date?

Imported: 
{
      "type" : "typename",
      "active" : true,
      "@timestamp" : "2020-09-29T07:03:55.857Z",
      "solved_date" : "",
}

Status Changed: 
{
      "type" : "typename",
      "active" : false,
      "@timestamp" : "2020-09-29T07:03:55.857Z",
      "solved_date" : "2020-10-05T07:03:55.857Z",
}
2

@r97 Welcome to the Discuss forum!

A line chart shows a change in something, so I'm not sure what you're actually trying to achieve. If you want to show the change in the number of objects that have "active": true over time, then you could create a basic histogram of the documents (the objects) and add a filter to only show those that have active: true.

The type of chart you can create depends on the version of the stack you're running and if you're running under a basic (or higher) license vs oss.

Here are a few links that might help get you started with Visualizations in Kibana:

3

Thanks for your reaction. But it doesn't solve the problem. The problem is that I need to count the active ones between the created and closed dates. Because the boolean changes to false while the value gets updated. So I want to see the view with a date and how many active items there are on this date. Like i have 3 issues with the dates:

Issue opened on 10-05-2020
issue closed on 25-05-2020

I want to see the count (3) in the Line Graph between those dates.
I'm on version 7.9.1 basic licence

4

@r97, I'm trying to get a mental picture of the graphs you want and need to make sure I'm on the same page as you: Do you want a line chart with dates on the x-axis and the count of active items on the y axis? A graph like that will show the number of active items there are on any particular date.

If that's the case, could you give a mocked example of the items? If not, I can try to mock up some data based on the example above.

5

Below is what I created with docs from another mock index. I want to do the same with the index structure listed in my first post. The issue is structuring/filtering the data to count the right numbers from active objects and the inactive objects between the dates.

I hope you can help me with that.

Linegraph
Linegraph1047×764 21.8 KB

6

That mocked data vis looks great! I think you should be able to create the visualization reasonably easily using a Line graph:

  1. Create a new Line visualization using the index that contains the data
  2. Use a Date Histogram as your x-axis aggregation with the timestamp as your field. You should be able to leave the minimum interval as auto (or change it later for more/less granularity).
  3. Use a count as your y-axis Metric
  4. Using the global filter option right at the top of the page, below the search bar, add a filter with Field = active and the value as true.

The visualization will give you a count of the number of 'active' items for each date because we're plotting all the items and then filtering out those that are closed.

If you want to plot the sum of items over time that are active, I recommend using TSVB with a filter ratio of the number of active items that are true divided by all the items we have by that date. You might need to create some additional fields to plot those values though (using a sum aggregation in a pipeline for the total doc count you have per date). There's a Discuss post that covered something similar here.

I hope that gives you what you're looking for.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.