# Host/Beats Agent Table

**URL:** <https://discuss.elastic.co/t/host-beats-agent-table/119894>\
**Category:** Kibana\
**Created:** [February 15, 2018, 12:26am UTC](https://discuss.elastic.co/t/host-beats-agent-table/119894 "2018-02-15T00:26:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [February 15, 2018, 12:26am UTC](https://discuss.elastic.co/t/host-beats-agent-table/119894/1 "2018-02-15T00:26:37Z")

</div>

Is it possible to configure a table that reports either # of events received or just the presence of the agent on the host?

```
Host	AuditBeat	FileBeat	MetricBeat	PacketBeat	WinLogbeat
Host 1					
Host 2					
Host 3
```

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [February 15, 2018, 5:11pm UTC](https://discuss.elastic.co/t/host-beats-agent-table/119894/2 "2018-02-15T17:11:56Z")

</div>

Since each beat type writes to a different index, not sure how to get a single chart that does what you are looking for. Per beat, you could do a terms aggregation on host for x axis and count aggregation for y and that would display all the hosts you were getting beat data from for that type. It would not show you hosts that had not reported any data as there aren't documents from those hosts in the index. Hope this helps.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 15, 2018, 7:09pm UTC](https://discuss.elastic.co/t/host-beats-agent-table/119894/4 "2018-02-15T19:09:16Z")

</div>

You may actually be able to do it through a table visualisation created through time-series visual builder.

Under `Panel Options`, set `Index Pattern` to `*beat-*` to catch all Beats related indices.

Under `Columns`, select `beat.hostname` as the `Group By Field`.

Then create a column for each type of beat you have deployed. Select a `Count` aggregation and under `Option` you then add an appropriate filter, e.g. `beat.name: filebeat`.

This may need a bit of tweaking, but might actually work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2018, 8:17pm UTC](https://discuss.elastic.co/t/host-beats-agent-table/119894/6 "2018-03-15T20:17:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.