Data Table multiple event IDs

[LeeDr (Lee Drengenberg)]

I'm thinking that's going to be pretty hard to do in Kibana (if it's even possible at all). I expected you would have to use the Advanced JSON Input field. Here's one example;

Display concurrency in data on Kibana

Wow, nice script @colings86 and @jpountz @EricK if you have scripting enabled in elasticsearch you can use it within your date_histogram by overriding the aggregations parameters with the "JSON input" advanced config option. This would look something like the screenshot below (note the field: null bit which removes the field parameter from the params): [image]

You might need to post a question in the Elasticsearch channel to ask how to write the appropriate query and then come back to Kibana and try to create the visualization .