Creating two graphs in same plot

(Mathias) #1


I monitor number of packets sent and received in my network and would like to visualize this in Kibana.
I can plot one entity at the time but I would like to see both at the same time.
I have data looking like this:

"port": 46156,
"name": "n_sent_packets",
"type": "counter",
"value": 283097,
"timestamp": "2017-02-08T13:37:34.499147891Z"

"port": 46156,
"name": "n_received_packets",
"type": "counter",
"value": 156283,
"timestamp": "2017-02-08T13:37:34.499147891Z"

As you can see, both counters stores the interesting data in a field called value.
When I make a search for for both "n_sent_packets" and "n_received_packets" I will see the sum when I try to make a graph.

Is it possible to show two individual graphs when data is stored using the same field name?
If so, how?

Br Mathias

(Peter Pisljar) #2

if i understand correctly you could do go to visualize->vertical bar chart, select histogram as your x axis aggregation, then add another aggregation to split terms, select term aggregation, select name as a field

you might want to set filters to limit names only to this two options (in case you have more)

(Mathias) #3

Hi ppisljar,

The problem is that I get two bars with exactly the same height (= sum of both counters)

I want one bar to sum the values of all events and having the field "n_sent_packets" and the other bar should sum the values of all events having the field "n_received_packets".

Is this possible?

Br Mathias

(Peter Pisljar) #4

you defined two metrics ....

you should add a term bucket agg ... under the buckets click add bucket, select split terms then select term agg

(Mathias) #5

I am reading your instruction over and over again but I can not make it right.
I do not find any split tems, I can choose between "split bar" and "split chart"

The result looks loki this:

Both counters still shows the same values.

Do I miss some functionality in my Kibana since I do not find "split term" or is it a typo?

Please give me more hints.

Kinds regards

(Mathias) #6

I think it is actually working.
It seems like my input data caused the bars to have equal size.
I will test on real data to be sure.


(Peter Pisljar) #7

yeah your last screenshot looks correct.

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.