# Feeling stupid - How to I recreate this kibana 3 chart

**URL:** <https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184>\
**Category:** Kibana\
**Created:** [April 22, 2016, 3:20pm UTC](https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184 "2016-04-22T15:20:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alan\_Hollis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alan_hollis/32/9362_2.png) [@Alan\_Hollis](https://discuss.elastic.co/u/Alan_Hollis)\
**Post date:** [April 22, 2016, 3:20pm UTC](https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184/1 "2016-04-22T15:20:28Z")

</div>

Hi all,

I'm feeling really stupid. We have some really basic dashboards that are set up for Kibana 3 and for the life of me I can't figure out how to re-create them in kibana 4, despite much googling.

The dashboard I'm trying to re-create is as follows:

[http://imgur.com/Ssv3lbG](http://imgur.com/Ssv3lbG)

We find this really useful as a quick glance tells us if something odd is going on ( for instance those errors from 15:20 ). I've tried to re-create this in Kibana 4 but I have no idea how I can split the columns accurately.

Presumably I have to use the json input field to restrict it but the best I've got is this...

[http://imgur.com/tvitzDN](http://imgur.com/tvitzDN)

Which is basically broken as there are no logs with "level:error" in my data.

If anyone could help me out with an example I'd be very appreciative!

Thank you,

Alan

---

<div class="post-metadata">

**Author:** ![Alan\_Hollis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alan_hollis/32/9362_2.png) [@Alan\_Hollis](https://discuss.elastic.co/u/Alan_Hollis)\
**Post date:** [April 22, 2016, 3:26pm UTC](https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184/2 "2016-04-22T15:26:49Z")

</div>

ARG!

I just figured it out.... For the next person who might find this...

To do this you need to

- Create the X-Axis
- Click the "Add sub-buckets" bar
- Click Split Bar
- Change sub aggregation to terms
- Select the field ( in my case level.raw )
- Click order ( in my case metric: Count )
- Hit save

Done....

Although this only gets me half way there, as I now need to figure out how I can also show other fields than level.... although that might be best visualised differently..

---

<div class="post-metadata">

**Author:** ![Court](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/court/32/6640_2.png) [@Court](https://discuss.elastic.co/u/Court)\
**Post date:** [April 22, 2016, 6:57pm UTC](https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184/3 "2016-04-22T18:57:50Z")

</div>

Thanks for updating us with your solution!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:55pm UTC](https://discuss.elastic.co/t/feeling-stupid-how-to-i-recreate-this-kibana-3-chart/48184/4 "2017-07-06T13:55:16Z")

</div>


