# Creating Kibana visualization using Kibana Query

**URL:** https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241
**Category:** Kibana
**Created:** [June 25, 2018, 11:48am UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241 "2018-06-25T11:48:20Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![eswarloges](https://avatars.discourse-cdn.com/v4/letter/e/8e7dd6/32.png) [@eswarloges](https://discuss.elastic.co/u/eswarloges)
#### Post date: [June 25, 2018, 11:48am UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/1 "2018-06-25T11:48:21Z")

</div>

Hi Team,

I have created an index with information like userid, name, loglevel (ERROR,WARN,DEBUG), logtime and the logmessage.

I wanted to know which user has got the maximum error count. I am able to create the kibana query.

GET testmetrics/\_search  
{  
"size": 0,  
"query": {  
"match": {  
"level": "ERROR"  
}  
},"aggs": {  
"useraggs": {  
"terms": {  
"field": "user.keyword",  
"order": {  
"\_count": "desc"  
},"size": 1  
}  
}  
}  
}

How do I achieve the same in Visualization in Kibana.

Thanks  
Loki

---

<div class="post-metadata">

### Author: ![Suhas\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suhas_k/32/31525_2.png) [@Suhas\_K](https://discuss.elastic.co/u/Suhas_K)
#### Post date: [June 25, 2018, 12:15pm UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/2 "2018-06-25T12:15:28Z")

</div>

Hey @eswarloges,

You can achieve it using **Data Table** visualisation. Choose **Count** from the Metrics section and in Buckets select **Split Rows -\> Terms (in Aggregation)**. Next select the **user** as the field and select the other options as required. Finally add a filter(use the _+ Add a filter_ option just below the search box) with the field as _Level_ and value as _ERROR_. Apply the changes to generate the data table.

Regards

---

<div class="post-metadata">

### Author: ![eswarloges](https://avatars.discourse-cdn.com/v4/letter/e/8e7dd6/32.png) [@eswarloges](https://discuss.elastic.co/u/eswarloges)
#### Post date: [June 25, 2018, 1:19pm UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/3 "2018-06-25T13:19:26Z")

</div>

I want to display the metric only for the user with highest ERROR.

This is what I did.

In kibana visualization

1. In **Metrics** I have chosen **Count**
2. in **Buckets** I have chosen **Terms** aggregation ,field as **user.keyword** , Order By **metric.count** and **Order** by **Descending**
3. In filter I have chosen **level.keyword** as **ERROR**

I am getting 3 metrics as a result

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb595d2d1cdba359a633d5e783e7e662bbf75573.png)

But I want to display only the user with maximum value ie User1

Thanks,  
Loki

---

<div class="post-metadata">

### Author: ![Red\_Thomas](https://avatars.discourse-cdn.com/v4/letter/r/7cd45c/32.png) [@Red\_Thomas](https://discuss.elastic.co/u/Red_Thomas)
#### Post date: [June 25, 2018, 2:01pm UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/4 "2018-06-25T14:01:37Z")

</div>

There's a size option in the query. If you set it to "1," does that give you what you're looking for?

---

<div class="post-metadata">

### Author: ![eswarloges](https://avatars.discourse-cdn.com/v4/letter/e/8e7dd6/32.png) [@eswarloges](https://discuss.elastic.co/u/eswarloges)
#### Post date: [June 26, 2018, 5:02am UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/5 "2018-06-26T05:02:39Z")

</div>

It worked. Thanks all 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2018, 5:03am UTC](https://discuss.elastic.co/t/creating-kibana-visualization-using-kibana-query/137241/6 "2018-07-24T05:03:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.