Help on a special visualisation

[CryptArks]

Hello everyone,
I'm having troubles looking for a unique count formula.
Here's how my data is working :

PUT /general
{
  "mappings": {
    "events": {
      "properties": {
        "type": {
          "type": "keyword"
        },
        "address": {
          "type": "keyword"
        },

My type has multiple events, and i'm looking for type : "created"
If I hit on discover on kibana type : created, I'll have all my created types.
I want to show a unique count having the type:"created" with a unique address.

So I tried a filter in discover under the type:created such as :

{
"size": 0,
 "aggs": {
   "uniqueValueCount": {
     "cardinality": {
       "field": "mappings.events.address.keyword"
     }} }} 

But well it's not working, i'm totally new at this any help would be greatly welcome

Thanks!

[CryptArks]

Anyone can help?

[Brandon_Kobel]

Hey @CryptArks, would you mind describing the final output that you're looking to generate? Are you looking for a table of unique addresses with their count which also have type: created?

[CryptArks]

Hi @Brandon_Kobel,
Thank you very much for your help,
Exactly, the other way around, i'm looking for a count (or table) about :
type:created and unique addresses

So counting all the type:created that have unique addresses, and add this count to my dashboard.

[Brandon_Kobel]

Hey @CryptArks, it sounds like the Data Table Visualization is what you're looking for with a terms aggregation.

[CryptArks]

Hi @Brandon_Kobel
Yes that's exactly what i tried to do.
To do the visualization i tried 2 things :
1st : On discover filter by type:created and add a filter in querydsl with the aggregation i tried to do on top. The code didn't work so i got stucked.
2nd : I saved a search type:created and opened it as a Data Table Visualization.
Then to add the terms aggregation the address term is not popping up.

I got 376 created, but the address is not coming up on the field to sort it.

Thanks for your help

[Brandon_Kobel]

You'll want to ensure that the address field is aggregatable, the easiest way to do so is to ensure it's mapping type is keyword and then refresh your index pattern in Kibana.

[CryptArks]

@Brandon_Kobel
As my data indicates, I've put address as a keyword just for this matter, but i still do not get how to make it with the aggregate.

When on discover typing type:created, I can see all the addresses on the fields on the bottom and the top 5 values of the same addresses.
I just want to count the type:created with unique addresses.

Still can't make this work.

[Brandon_Kobel]

@CryptArks

Using the following fake data:

POST crypta/doc
{
  "address": "foo",
  "type": "created"
}

POST crypta/doc
{
  "address": "bar",
  "type": "created"
}

POST crypta/doc
{
  "address": "bar",
  "type": "created"
}

POST crypta/doc
{
  "address": "red herring",
  "type": "updated"
}

I'm able to create a Data Table with the following configuration:

Is this similar to what you're looking for?

[CryptArks]

@Brandon_Kobel
Thank you Brandon! this helped me quite a lot,
Doing this I do have that same view as yours : But I have around 500 Created now, and when i apply the aggregation only 6-7 are showing up in my table.

Changing the size does not change it and adding 100 per page in Option adds me more line but not values

How do I change the N value displayed on my table?

Thanks again!

[Brandon_Kobel]

You'll want to change the "Size" of the terms aggregation:

[CryptArks]

Hi @Brandon_Kobel,
Thanks for your answer so far.
Is there no way to put this as a query so that I can visualize this as a line/area/vertical bar?

Thanks

[Brandon_Kobel]

Hey @CryptArks, you can build a Line/Area/Vertical-bar chart using the same aggregations to get a visual output.