# Creating visualization with the single logline message **URL:** \ **Category:** Kibana\ **Created:** [March 10, 2023, 6:43am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417 "2023-03-10T06:43:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Post date:** [March 10, 2023, 6:43am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/1 "2023-03-10T06:43:47Z")
We have one usecase to create the visualization We have below fields in one log message :- requestedMsgCount 2500 allowedMsgCount 2400 startedMsgCount 2400 lostMsgCount 10 terminatedMsgCount 100 Now i want to create a visualization on the above fields in the below manner 1. The visualization shows the data only for the new logline(single message) . Is this possible to create with the new logline ? 2. There should be a bar graph which will show the requestedMsgCount and allowedMsgCount in single bar(Rejected rate) in which it shows the total message 2500 and difference between requestedMsgCount and allowedMsgCount(2500-2400=100). Same for the other fields. Please refer the diagram for more blue represents for requestedMsgCount and red for rejected(requestedMsgCount - allowedMsgCount). So out of 2500 100 message are rejected ![diagram](https://us1.discourse-cdn.com/elastic/original/3X/8/1/819b734963064d52dee6b7cdb18d597b547b2ed0.png) Could someone please help us in creating the above visualization? ---
**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Post date:** [March 13, 2023, 5:41am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/2 "2023-03-13T05:41:20Z")
any update ? ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [March 13, 2023, 12:36pm UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/3 "2023-03-13T12:36:36Z")
Hi, what is the index setting? "log message" means one `document`? If so, it is difficult to visualize data from a single document. Kibana visualization is almost specialized in aggregating multiple documents. If you have one document per one message and you can count them by aggregation query, the visualization might be easy. ---
**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Post date:** [March 13, 2023, 3:58pm UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/4 "2023-03-13T15:58:30Z")
Thanks for the reply @Tomo_M "log message" means one `document` : yes The sample message looks like this ```auto 2023-03-03 14:49:26.312 [INFO] - {"logtype":"Test","operation":"TestStatus","startedMsgCount":18,"allowedMsgCount":18,"requestedMsgCount":19,"lostMsgCount":0,"terminatedMsgCount":0,"totalLostMsgCount":271,"totalTerminatedMsgCount":991,"totalLostCeiling":3000,"totalTerminatedCeiling":15000} ``` This message will generate at regular interval for ex:- every 2min some messages are generated. So we want to create visualization on the latest logline only. The attached diagram represents only for single message. I have tried some scenarios but I can only find the aggregation terms in visualization nothing related to individual message count. The drawback is that if i change the time it will affect the complete visualization. what is the index setting? :- What exactly i can provide ? we are parsing the above logs and stored the fields as individual. Could you please help us in the usecase? Please let me know if information required from my side ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [March 14, 2023, 1:45am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/5 "2023-03-14T01:45:14Z")
One option is using vega. If you want to use Lens, you have to store messages themselves as documents and aggregate them by elasticsearch and kibana. > **[Vega | Kibana Guide \[8.6\] | Elastic](https://www.elastic.co/guide/en/kibana/current/vega.html)** > > Consider the production components that are used to generate reports. ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [March 17, 2023, 5:34am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/6 "2023-03-17T05:34:33Z")
hi @prashant1, I have to apologize for my previous wrong information. I found a way to (partialy) implement your requirements. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9b72c2e49261be7bd7d74801315c80ca1c0830cd.png) Using "Bar vertical stacked" and set "Last value of" for vertical axis. Then you can create a vertical stacked barchart for the values in the latest document. Problem (in my environment) is that even if you use "Layers", the values are stackd in the same bar. There could be some method but I could not find it. One workaround might be to create two Lens visualisation side by side. ---
**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Post date:** [March 17, 2023, 9:21am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/7 "2023-03-17T09:21:55Z")
Thanks for the information @Tomo_M I will try this and let you know. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2023, 9:22am UTC](https://discuss.elastic.co/t/creating-visualization-with-the-single-logline-message/327417/8 "2023-04-14T09:22:56Z")
Closed on April 14, 2023, 9:22am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.