Creating two graphs in same plot


I monitor number of packets sent and received in my network and would like to visualize this in Kibana.
I can plot one entity at the time but I would like to see both at the same time.
I have data looking like this:

"port": 46156,
"name": "n_sent_packets",
"type": "counter",
"value": 283097,
"timestamp": "2017-02-08T13:37:34.499147891Z"

"port": 46156,
"name": "n_received_packets",
"type": "counter",
"value": 156283,
"timestamp": "2017-02-08T13:37:34.499147891Z"

As you can see, both counters stores the interesting data in a field called value.
When I make a search for for both "n_sent_packets" and "n_received_packets" I will see the sum when I try to make a graph.

Is it possible to show two individual graphs when data is stored using the same field name?
If so, how?

Br Mathias

if i understand correctly you could do go to visualize->vertical bar chart, select histogram as your x axis aggregation, then add another aggregation to split terms, select term aggregation, select name as a field

you might want to set filters to limit names only to this two options (in case you have more)

Hi ppisljar,

The problem is that I get two bars with exactly the same height (= sum of both counters)

I want one bar to sum the values of all events and having the field "n_sent_packets" and the other bar should sum the values of all events having the field "n_received_packets".

Is this possible?

Br Mathias

you defined two metrics ....

you should add a term bucket agg ... under the buckets click add bucket, select split terms then select term agg

I am reading your instruction over and over again but I can not make it right.
I do not find any split tems, I can choose between "split bar" and "split chart"

The result looks loki this:

Both counters still shows the same values.

Do I miss some functionality in my Kibana since I do not find "split term" or is it a typo?

Please give me more hints.

Kinds regards

I think it is actually working.
It seems like my input data caused the bars to have equal size.
I will test on real data to be sure.


yeah your last screenshot looks correct.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.