# Help visualising uptime data in Kibana

**URL:** <https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136>\
**Category:** Kibana\
**Created:** [April 1, 2020, 11:28pm UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136 "2020-04-01T23:28:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)\
**Post date:** [April 1, 2020, 11:28pm UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/1 "2020-04-01T23:28:50Z")

</div>

Hi - I am ingesting uptime messages from some custom code that provides me with

`UptimeXML=<nus><s u="true" s="1585627182" e="1585627182"/></nus>`

's' is the start of an uptime period and 'e' is the end of that same period. Periods can be of different durations.

From this, I can use logstash to parse out the start and end epoch time of an 'up period'.

I don't get anything for 'down periods' - they are implied by their absence.

Using these events I would like to plot an 'uptime visualization' in Kibana - line or bar - showing the uptime periods above the horizontal axis and the implied downtime periods on the horizontal axis. Time running normally from left to right.

I am struggling to see how to do that - any bright sparks out there able to point me in the right direction so I can make a start?

Many thanks

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [April 3, 2020, 9:38am UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/2 "2020-04-03T09:38:14Z")

</div>

Hi and welcome back!

So when I hear about update messages, I think of a server frequently sending messages to Elasticsearch, and you could use a date histogram to visualize those messages. the down periods would be the gap. But your system is different, you don't get the messages frequently, but in a kind of bulk, with an start and and end, that can be unlike the example you provided differently, do I understand this correctly?

thx & best,  
Matthias

---

<div class="post-metadata">

**Author:** ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)\
**Post date:** [April 3, 2020, 10:03pm UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/3 "2020-04-03T22:03:52Z")

</div>

Hi Matthias - Thanks for the message!

yes, a perfect description of what I am getting.

Happy that the downtime will appear as 'gaps' but really strugging to see how I go about creating events from logstash that will allow me to visualise the uptime periods which come in with both a start and stop time?

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [April 6, 2020, 7:37am UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/4 "2020-04-06T07:37:57Z")

</div>

You could use the logstash ruby filter to analyze the input record, and to generate additional events if necessary:

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html)

so if you want an uptime record every 5 seconds, and you get an record with a duration of 10s, you could add another record with a timestamp + 5s. then it would be easy to build a visualization.

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)\
**Post date:** [April 6, 2020, 11:10pm UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/5 "2020-04-06T23:10:29Z")

</div>

Thanks Matthias

I wondered if regenerating 'normal' uptime events might be the way to go. I'll have a play - appreciate your pointing me in the right direction and its good to know I'm not missing something really obvious!

Thanks again,

John

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2020, 11:10pm UTC](https://discuss.elastic.co/t/help-visualising-uptime-data-in-kibana/226136/6 "2020-05-04T23:10:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
