Fitlers in buckets are not working in kibana pie chart

I am trying to add multiple Monitors and their up and down status in in single Pie visualization. Each monitor as a donut and up and down status are as slices.
I used below:
Metric: Count
Bucket 1: filter and monitor.status:up and mointor.status:down
Bucket 2: filter and monitor.status:up and mointor.status:down
Bucket 3: filter and monitor.status:up and mointor.status:down

I am expecting 3 donuts but i am seeing only 1.
May I know what i am missing to get 3 donuts.

Hi @PraveenKT,

you can achieve this by doing two separate "filters" aggregations - one to split the slices and one to split the charts themselves. The screenshot is cut of in this place but it looks like you have two separate bucket aggregations both for slice splitting - this would create a hierarchical pie chart. If you add a bucket aggregation you can select whether you want to split the chart or the slices.

The chart split aggregation should have the filters "", "" and "", the slice split aggregation should have the filters "monitor.status:up" and "monitor.status:down".

Let me know whether that helps.

Hello Joe Reuter,

Thank you for the reply. I adding filters "" to Split chart and monitor.status:up and down to split slice. I am getting 3 separate Donuts(colouman splitted based on

But I am expecting like below, 3 donuts one on above with up and down status.

Ah sorry, then I misunderstood you. In that case two "split slices" bucket aggregations are the right thing to do, with the filters in the original answer.

So first "split slices" has "", "" and "" and second split slices has "monitor.status:up" and "monitor.status:down". If you define multiple bucket aggregations they are "nested" into each other, so with this filters configuration you will get the up and down status for each monitor.

Hello Joe Reuter,

I tried as you told but no luck. PFA screenshot

What are you expecting exactly? The chart from your screenshot looks the same for me as the one from the Metricbeat dashboard above. For nice labels instead of the queries you can click on the little tag icon next to the filter input and specify one.

Hello Joe,

I am expecting donut for every Heartbeat monitor and one on another not side by side. in above screenshot i am seeing all the heartbeat monitors in single donut.

But isn't that exactly the result you had in the third post in this thread? You have three donuts there, one for each monitor with the up and down status as slices. If you want to further split the slices for each donut, you can keep adding "Split slices" filters aggregations.

What exactly do you mean by "and one on another"?


As shown in below diagram each donut represent a Heart monitor. and each donut further divided into UP & DOWN count.

I see, that's not possible with the pie visualization. The "rings" always indicate a hierarchy whereas in your case each ring would be unrelated to the ring before.

You could try to build such a visualization with Vega or Canvas where you have more freedom in how the visualizaton looks. These alternatives have downsides though - Vega is basically a separate programming language and not easy to learn and Canvas visualizations are currently not embeddable in dashboards.

However as this way of visualizing data is pretty uncommon, for your use case I would suggest using a two-ring donut in which the rings form a hierarchy (just like in the metricbeat example you posted and in your post following that) or even a bar chart which makes it easier to grasp the information you want to show.

Got it thank you for your support.