# Group by in Kibana Lens

**URL:** <https://discuss.elastic.co/t/group-by-in-kibana-lens/357406>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting, lens\
**Created:** [April 15, 2024, 10:15am UTC](https://discuss.elastic.co/t/group-by-in-kibana-lens/357406 "2024-04-15T10:15:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stukero](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@Stukero](https://discuss.elastic.co/u/Stukero)\
**Post date:** [April 15, 2024, 10:15am UTC](https://discuss.elastic.co/t/group-by-in-kibana-lens/357406/1 "2024-04-15T10:15:01Z")

</div>

Hello! I'm looking for some info about how to aggregate some fields and make a count, then show them in a particular way. I think you'll see it better with this:

Lets say we have an index called "my\_index" with documents like this:

```auto
 "_index" : "my_index",
 "_type" : "_doc",
 "_source" : {
 "date" : "2024-03-15T05:32:40.900Z",
 "top_id": "abc1234",
 "status_tracking" : [
 {
 "status" : "ok",
 "type" : "max"
 }
 ], 

```

Now, in this code "top\_id" is the identification of a robot. "type" is the type of the alarm the robot sends. Everytime the robot has any problem, it generates a new document with the type of the alarm, so every top\_id has 1-50 documents associated with one of the 4 alarms types we have.

What i want is a table in my dashboard that shows the quantity of alarms of each type every top\_id has. For example, the top\_id = abc1234 has 23 max, 11 min, 39 mean and 13 fol (max, min, mean and fol are alarms types) Do you know how can I do it? Tysm!

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [April 29, 2024, 4:19pm UTC](https://discuss.elastic.co/t/group-by-in-kibana-lens/357406/2 "2024-04-29T16:19:21Z")

</div>

If your possible values are controlled you can just create a table and add metrics filtering for each `status_tracking.type` value

I did a test as follows. First create some sample data and a dataview (next time you could provide this kind of sample data for faster resolution)

```auto
# Cleanup if necessary
DELETE discuss-357406

# Create the index with required fields
PUT discuss-357406
{
  "mappings": {
    "properties": {
      "ts": { "type": "date" },
      "top_id": { "type": "keyword" },
      "status_tracking": {
        "properties": {
          "status": { "type": "keyword" },
          "type": { "type": "keyword" }
        }
      }
    }
  }
}

# add some sample data varying the date, top_id 
# and the status_tracking.type
POST discuss-357406/_bulk
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc1", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-27T18:00:00+0200", "top_id": "abc123", "status_tracking": {"status": "ok", "type": "max" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc1", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-28T19:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "min" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc", "status_tracking": {"status": "ok", "type": "mean" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc12", "status_tracking": {"status": "ok", "type": "mean" }}
{ "index": {}}
{"ts": "2024-04-29T10:00:00+0200", "top_id": "abc123", "status_tracking": {"status": "ok", "type": "mean" }}

# Create the data view
POST kbn:/api/data_views/data_view
{
  "data_view": {
    "title": "discuss-357406",
    "timeFieldName": "ts"
  }
}

```

With that data you can create a Lens table with rows per top values of the `top_id` field and a different metrics

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/5/7553a8bbccd33b4ba49a867be121bb0d26478699.png)

Where each metric has a custom filter

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87d9014a9e2b6ec218f3e5f2a070921b302e1ab5.png)