# ElasticSearch DAU and MAU

**URL:** <https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405>\
**Category:** Kibana\
**Created:** [January 7, 2021, 4:32am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405 "2021-01-07T04:32:33Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 4:32am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/1 "2021-01-07T04:32:33Z")

</div>

Hello Team

In Kibana Visualisation Dashboard , we have option to get charts for DAU and MAU.

I would like to check the query used by Kibana in background to get the data.

My purpose is to get the query and use it in CURL to have data saved in a file text .

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2021, 4:40am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/2 "2021-01-07T04:40:38Z")

</div>

If you open the visualisation menu, the 3 dots in the top right, you can use the `Inspect` option to view the query that is sent to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 4:43am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/3 "2021-01-07T04:43:20Z")

</div>

Hello Mark

My Elasticsearch and Kibana version is 5.6.3

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2021, 4:44am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/4 "2021-01-07T04:44:59Z")

</div>

Then you should really upgrade, 5.X has been [EOL](https://www.elastic.co/support/eol) for quite a long time now.

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 4:45am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/5 "2021-01-07T04:45:01Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/852e2d38891b2a5d8e95a4d180c78a7ff0714b04.png)

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 4:46am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/6 "2021-01-07T04:46:14Z")

</div>

Yes Mark...

But due to infra limitation i have to be on ES 5.6.3 as of now.... Will be upgrading in coming months very soon.

Could you please help me with 5.6.3 I have pasted above my screen shot too..

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/7 "2021-01-07T05:10:31Z")

</div>

I am not able to get Inspect option in kibana 5.6.16

I am looking for various options in it.

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/8 "2021-01-07T09:27:22Z")

</div>

Secondly ,

Is there a provision , via shell-script or logstash or otherway via script { Automation } i can generate csv file of kibana DAU/MAU ?

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 7, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/9 "2021-01-07T14:07:50Z")

</div>

Hello Team

Finally , I was able to write a QUERY using CURL command and get the required data as below.

Could you please help me , how to get only

doc\_count: 11111111 , value : 222222

and exclude all other stuff using CURL command.

```auto
  "aggregations" : {
    "count_per_month" : {
      "buckets" : [
        {
          "key_as_string" : "2020-12-01T00:00:00.000Z",
          "key" : 1606780800000,
          "doc_count" : 86956624,
          "type_count" : {
            "value" : 2111421
          }
        },
        {
          "key_as_string" : "2020-12-02T00:00:00.000Z",
          "key" : 1606867200000,
          "doc_count" : 83205134,
          "type_count" : {
            "value" : 2139852
          }
        },
        {
          "key_as_string" : "2020-12-03T00:00:00.000Z",
          "key" : 1606953600000,
          "doc_count" : 87624223,
          "type_count" : {
            "value" : 2123403
          }
        },
        {
          "key_as_string" : "2020-12-04T00:00:00.000Z",
          "key" : 1607040000000,
          "doc_count" : 87149873,
          "type_count" : {
            "value" : 2141200
          }
        }
      ]
    }

```

---

<div class="post-metadata">

**Author:** ![tusharnemade](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Post date:** [January 8, 2021, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/10 "2021-01-08T06:34:24Z")

</div>

Hello Team

I was able to achieve same using `"jason query"` i.e. `"jq" `.

It took time , but was able to get it properly into csv file.

For your reference

```auto
jq -r ' .aggregations.count_per_month.buckets[] | [.key,.doc_count,.type_count[] ] | @csv' > 123.csv

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2021, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405/11 "2021-02-05T06:34:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
