# Creating two graphs in same plot

**URL:** https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377
**Category:** Kibana
**Created:** [February 8, 2017, 2:00pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377 "2017-02-08T14:00:44Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![mathias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mathias/32/23176_2.png) [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [February 8, 2017, 2:00pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/1 "2017-02-08T14:00:44Z")

</div>

Hi,

I monitor number of packets sent and received in my network and would like to visualize this in Kibana.  
I can plot one entity at the time but I would like to see both at the same time.  
I have data looking like this:

"port": 46156,  
"name": "n\_sent\_packets",  
"type": "counter",  
"value": 283097,  
"timestamp": "2017-02-08T13:37:34.499147891Z"

and  
"port": 46156,  
"name": "n\_received\_packets",  
"type": "counter",  
"value": 156283,  
"timestamp": "2017-02-08T13:37:34.499147891Z"

As you can see, both counters stores the interesting data in a field called value.  
When I make a search for for both "n\_sent\_packets" and "n\_received\_packets" I will see the sum when I try to make a graph.

Is it possible to show two individual graphs when data is stored using the same field name?  
If so, how?

Br Mathias

---

<div class="post-metadata">

### Author: ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [February 8, 2017, 3:27pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/2 "2017-02-08T15:27:23Z")

</div>

if i understand correctly you could do go to visualize-\>vertical bar chart, select histogram as your x axis aggregation, then add another aggregation to split terms, select term aggregation, select name as a field

you might want to set filters to limit names only to this two options (in case you have more)

---

<div class="post-metadata">

### Author: ![mathias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mathias/32/23176_2.png) [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [February 8, 2017, 5:15pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/3 "2017-02-08T17:15:14Z")

</div>

> [@ppisljar](#):
>
> then add another aggregatio

Hi ppisljar,

The problem is that I get two bars with exactly the same height (= sum of both counters)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0779788c541c58913f91805b1e6c192c40616cc8.png)

I want one bar to sum the values of all events and having the field "n\_sent\_packets" and the other bar should sum the values of all events having the field "n\_received\_packets".

Is this possible?

Br Mathias

---

<div class="post-metadata">

### Author: ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [February 8, 2017, 5:30pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/4 "2017-02-08T17:30:22Z")

</div>

you defined two metrics ....

you should add a term bucket agg ... under the buckets click add bucket, select split terms then select term agg

---

<div class="post-metadata">

### Author: ![mathias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mathias/32/23176_2.png) [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [February 8, 2017, 7:24pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/5 "2017-02-08T19:24:01Z")

</div>

I am reading your instruction over and over again but I can not make it right.  
I do not find any split tems, I can choose between "split bar" and "split chart"  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/eb940cce14f34adfd562bcdc3cc0f82637047f23.png)

The result looks loki this:  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/dea39ac7772e8da31fc2dfd9eeb2c8325aaabd53.png)

Both counters still shows the same values.

Do I miss some functionality in my Kibana since I do not find "split term" or is it a typo?

Please give me more hints.

Kinds regards  
Mathias

---

<div class="post-metadata">

### Author: ![mathias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mathias/32/23176_2.png) [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [February 8, 2017, 7:54pm UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/6 "2017-02-08T19:54:16Z")

</div>

I think it is actually working.  
It seems like my input data caused the bars to have equal size.  
I will test on real data to be sure.

Thanks  
Mathias

---

<div class="post-metadata">

### Author: ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [February 9, 2017, 8:25am UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/7 "2017-02-09T08:25:42Z")

</div>

yeah your last screenshot looks correct.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2017, 8:26am UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377/8 "2017-03-09T08:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
