# Create visualization with actual status of process ("group by"?/subquery?)

**URL:** <https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379>\
**Category:** Kibana\
**Created:** [January 6, 2021, 6:42pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379 "2021-01-06T18:42:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joao\_Palma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao_palma/32/45243_2.png) [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\
**Post date:** [January 6, 2021, 6:42pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379/1 "2021-01-06T18:42:17Z")

</div>

Hello,

I have a log file, like this :  
{"process": "X2", "status": "open", "@timestamp": "2021-01-05T15:34:41.061Z"}  
{"process": "X1", "status": "open", "@timestamp": "2021-01-05T15:35:42.061Z"}  
{"process": "X5", "status": "Updated", "@timestamp": "2021-01-05T15:36:46.061Z"}  
{"process": "X2", "status": "In progress", "@timestamp": "2021-01-05T15:38:48.061Z"}  
{"process": "X6", "status": "Closed", "@timestamp": "2021-01-05T15:39:49.061Z"}  
{"process": "X2", "status": "Updated", "@timestamp": "2021-01-05T15:40:46.061Z"}  
{"process": "X2", "status": "Closed", "@timestamp": "2021-01-05T15:48:49.061Z"}

The app logs multiple status but one process have only one status and it's the most recent log.  
And I want a visualization like this:  
Open: 1 (X1)  
Updated: 1 (X5)  
Closed: 2 (X2 and X6)

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [January 6, 2021, 6:44pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379/2 "2021-01-06T18:44:30Z")

</div>

What you're asking about is frequently called entity-centric indexing. You have timeseries logs, but you want to convert them into a single status per process. This can be done using the [transforms feature](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) of Elasticsearch, or by changing something about how you index data to Elasticsearch.

If the number of documents you have is small, it might be possible to create this visualization using Vega- it is the most customizable visualization in Kibana.

---

<div class="post-metadata">

**Author:** ![Joao\_Palma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao_palma/32/45243_2.png) [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\
**Post date:** [January 7, 2021, 11:56am UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379/3 "2021-01-07T11:56:43Z")

</div>

> [@wylie](#):
>
> transforms feature

Thanks Wylie  
But You I can do this with [transforms feature](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html)? In SQL I have to do in two queries.. And here I can't see how I can do this..  
I try Group By process and agregation with timestamp.max but this isn't I want...

You can tell me how I can do this?

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [January 7, 2021, 4:32pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379/4 "2021-01-07T16:32:51Z")

</div>

This is about to get a lot easier in the release of 7.11, but for now it's a little complicated. In 7.11 the transforms feature will get a "latest only" mode: [https://www.elastic.co/guide/en/elasticsearch/reference/7.11/put-transform.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/put-transform.html)

What you can do is set up a transform that:

1. Splits by a date histogram with whatever interval you want
2. Split by status
3. Uses a terms aggregation to get all process names

Then you can create a data table. Bucket by Terms of process.name, and the metric is Top Hits of process.status, sorted by timestamp.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2021, 4:32pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379/5 "2021-02-04T16:32:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.