# Creating Gauge Visualization
**URL:** https://discuss.elastic.co/t/creating-gauge-visualization/122384
**Category:** Kibana
**Created:** [March 3, 2018, 6:59pm UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384 "2018-03-03T18:59:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [March 3, 2018, 6:59pm UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384/1 "2018-03-03T18:59:31Z")
I have a field that contains one of two values, pass or fail. I'd like to setup a gauge with the following math:
Total # of field occurrence / Total # field = pass
This should leave me with an integer between 0.0 to 1.0 which could then be expressed as a decimal. The upper bounds of the gauge would be the total count of the field with the amount of fill on the gauge being the count that matches pass. If that makes sense....
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [March 3, 2018, 8:09pm UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384/2 "2018-03-03T20:09:58Z")
Can you give a few examples documents in Elasticsearch so we can see what the structure and field values look like?
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [March 3, 2018, 8:21pm UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384/3 "2018-03-03T20:21:59Z")
You mean something like this?? It's the email.spf\_evaluation field. It's going to be a string vaule of pass or fail.
```
{
"_index": "dmarcxml-2018.03.62",
"_type": "doc",
"_id": "N-nn6mEBsGXTOKCBQqtC",
"_version": 1,
"_score": null,
"_source": {
"email.dmarc_action": [
"none"
],
"authresult.spf_result": [
"pass"
],
"report.start": [
"1518220800"
],
"report.org_contact": [
"dmarc_support@corp.mail.ru"
],
"policy.dmarc.subdomain_action": [
"none"
],
"policy.percentage": [
"100"
],
"@timestamp": "2018-03-03T08:07:59.247Z",
"report.additional_contact": [
"http://help.mail.ru/mail-help"
],
"email.dkim_evaluation": [
"fail"
],
"email.count": [
"1"
],
"policy.dkim_mode": [
"r"
],
"report.org": [
"Mail.Ru"
],
"email.source_ip": [
"192.168.1.1"
],
"policy.domain": [
"example.com"
],
"policy.spf_mode": [
"r"
],
"authresult.spf_scope": [
"mfrom"
],
"path": "C:/DMARC/mail.ru!example.com!1518220800!1518307200.xml",
"email.header_from": [
"example.com"
],
"report.id": [
"37256247916566362691518220800"
],
"authresult.spf_domain": [
"example.com"
],
"email.spf_evaluation": [
"pass"
],
"geoip": {
"latitude": 37.4249,
"dma_code": 807,
"city_name": "Sunnyvale",
"location": {
"lat": 37.4249,
"lon": -122.0074,
"coordinates": "37.4249, -122.0074"
},
"country_name": "United States",
"country_code3": "US",
"region_code": "CA",
"longitude": -122.0074,
"region_name": "California",
"continent_code": "NA",
"ip": "192.168.1.1",
"timezone": "America/Los_Angeles",
"postal_code": "94089",
"country_code2": "US"
},
"message": " \r\n \r\n 192.168.1.1\r\n 1\r\n \r\n none\r\n fail\r\n pass\r\n \r\n
\r\n \r\n example.com\r\n \r\n \r\n \r\n example.com\r\n mfrom\r\n pass\r\n \r\n \r\n \r\n Mail.Ru\r\n dmarc_support@corp.mail.ru\r\n http://help.mail.ru/mail-help\r\n 37256247916566362691518220800\r\n \r\n 1518220800\r\n 1518307200\r\n \r\n \r\n \r\n example.com\r\n r\r\n r\r\n none
\r\n none\r\n 100\r\n \r\n \r",
"policy.dmarc.domain_action": [
"none"
],
"report.end": [
"1518307200"
],
"tags": [
"multiline"
]
},
"fields": {
"report.end": [
"2018-02-11T00:00:00.000Z"
],
"report.start": [
"2018-02-10T00:00:00.000Z"
],
"@timestamp": [
"2018-03-03T08:07:59.247Z"
]
},
"sort": [
1520064479247
]
}
```
---
### Author:  [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [March 4, 2018, 1:53am UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384/4 "2018-03-04T01:53:56Z")
Well, I'm really not sure here but sometimes I'm a little bit lucky from just exploring the screens and guessing.
Using TSVB, you can start with a `count` aggregation that gives a count for the number of documents in each time bucket. Then make another metric in the same series, and choose `Filter Ratio`. Numerator and Denominator are both filters, so your numerator will be `email.spf_evaluation:pass` and the denominator will be `*`.
In general, the way I use TSVB is to start with the Time Series chart and make sure my series are creating a shape of data over time that looks right. Then I would switch to Guage to see the "last" ratio bucket as a single metric.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2018, 1:54am UTC](https://discuss.elastic.co/t/creating-gauge-visualization/122384/5 "2018-04-01T01:54:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.