# How to configure a Bar graph visualization to only display unique values of a field?

**URL:** <https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081>\
**Category:** Kibana\
**Created:** [November 5, 2024, 3:55pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081 "2024-11-05T15:55:08Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 5, 2024, 3:55pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/1 "2024-11-05T15:55:08Z")

</div>

Hello there,

I know how to use an aggregation to query ES to display only unique values for a field, but I can't find how to do this in a Kibana "Bar Vertical" visualization:

 ![Screenshot 2024-11-05 at 16.50.14](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2c978437870a73aa8a794fdde850cce27779be50.jpeg)

I have found how to do it for a "Pie" visualization:

 ![Screenshot 2024-11-05 at 16.52.51](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e2b05a9bca9a9bcf5cb63f7fc908bb61e2a6e22.png)

I'd like to do the same for "Bar Vertical" and "filter" on `unique_count(distribution.instanceId)`.

If it helps, here's the dashboard: [Elastic](https://tinyurl.com/activeinstalls2)

Any idea?

Thanks a lot

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 6, 2024, 2:50am UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/2 "2024-11-06T02:50:30Z")

</div>

Hi @vmassol

I am not sure exactly what you are trying to do, but I think you just want to do a vertical bar graph. (not stacked, not percentage)

With Horizontal Axis: Top Values `java.version`  
With Vertical axis: `unique_count(distribution.instanceId)`

Here is mine where  
Horizontal Axis : Top Values of `service.name` ranked by descending `unique_count(kubernetes.pod.name)`

Vertical Axis : `unique_count(kubernetes.pod.name)` is the vertical axis

I adjusted the Axis to show all values

 ![Screenshot 2024-11-05 at 6.49.27 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc707b099bc75cc943ff732fc455ab939a3eb8d9.jpeg)

 ![Screenshot 2024-11-05 at 6.48.23 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e672393ad61a84ed5285b38a6199d369eed903f1.png)

 ![Screenshot 2024-11-05 at 6.45.05 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68c0a762f1458fa5acf8d2f7f0fbb961b2ebc105.png)

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 6, 2024, 9:48am UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/3 "2024-11-06T09:48:21Z")

</div>

> [@stephenb](#):
>
> ut I think you just want to do a vertical bar graph. (not stacked, not percentage)
> 
> With Horizontal Axis: Top Values `java.version`  
> With Vertical axis: `unique_count(distribution.instanceId)`

Thanks for your answer. This is not what I'm looking for.

I want the following (see my screenshot in the first post for the visual of it):

- Horizontal axis: `date.current`
- Vertical axis: sum of `users.total`

BUT considering only entries that are unique for the `distribution.instanceId` field (i.e. `unique_count(distribution.instanceId)`).

Thanks

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 6, 2024, 1:35pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/4 "2024-11-06T13:35:40Z")

</div>

Actually, to be even more precise, I'd like to find a way to have a date histogram visualization in Kibana, for "sumusers" below (defined using an ES query):

```auto
"aggs": {
    "by_day": {
      "date_histogram": {
        "field": "date.current",
        "calendar_interval": "1d",
        "time_zone": "Europe/Paris"
      },
      "aggs": {
        "instanceId_count": {
          "cardinality": {
            "field": "distribution.instanceId"
          }
        },
        "max": {
          "terms": {
            "field": "distribution.instanceId",
            "size": "2000"
          },
          "aggs":{
            "MAX_USERS":{
              "max": {
                "field": "users.total"
              }
            },
          }
        },
        "sumusers":{
          "sum_bucket": {
            "buckets_path": "max>MAX_USERS"
          }
        }
      }
    }

```

As you can see, the data is first aggregated on unique `distribution.instanceId`, then we find the `max(users.total)`and then we sum all max users.

The idea is to have a graph:

- X-axis: days
- Y-axis: sum of max `users.total` per unique `distribution.instanceId`

Is that possible?

Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 6, 2024, 3:17pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/5 "2024-11-06T15:17:27Z")

</div>

Since I can't get to your data

What you are describing is a Series Aggregation by Sum of the Series.  
The series being the max `users.total` by `distribution.instanceId`

In Lens Bar Chart

- X-axis: days: @timestamp in the x axis
- Y-axis: max `users.total`
- Breakdown by unique `distribution.instanceId` and collapse by `Sum`

This Sum, sums all the max `users.total` per `distribution.instanceId` into a total sum.

The Collapse By is the Key

 ![Screenshot 2024-11-06 at 7.15.11 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2abc17ec0c1cd3eae310c3370ea61f5c3b63e98.png)

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 6, 2024, 4:07pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/6 "2024-11-06T16:07:49Z")

</div>

Thanks a lot @stephenb!

I just can't find how to specify the _unique_ `distribution.instanceId` in the breakdown config:

 ![Screenshot 2024-11-06 at 17.05.01](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a77ae1fe0a87809078eb12c40733d3e0ba4478ea.png)

Thanks again, that's super helpful.

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 6, 2024, 4:13pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/7 "2024-11-06T16:13:41Z")

</div>

> [@stephenb](#):
>
> Since I can't get to your data

Note: You should be able to access [Elastic](https://tinyurl.com/activeinstalls2) normally.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 6, 2024, 5:30pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/8 "2024-11-06T17:30:58Z")

</div>

> [@vmassol](#):
>
> I just can't find how to specify the _unique_ `distribution.instanceId` in the breakdown config:

Apologies ... Top Values is Terms so it will be each distinct value of `distribution.instanceId`

But in short, if you want to break down by cardinality (which I am not even sure what that means) ... because in a time bucket, there will only be 1 cardinality value on a given field.

can you share the result of the agg query above... I am not sure you will be able to do this in lens.

In the query above there is no time dimension... so I am unclear on that...  
so is the X Axis a time bucket or a cardinality bucket? because within 1 timebucket there will only be 1 value for cardnality

> [@vmassol](#):
>
> Note: You should be able to access [Elastic](https://tinyurl.com/activeinstalls2) normally.

Yes I looked it is read-only (I understand why) so that is what I meant (I don't expect you to make it writeable)

cc @Marco_Liberati Any thoughts on this?

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [November 8, 2024, 12:46pm UTC](https://discuss.elastic.co/t/how-to-configure-a-bar-graph-visualization-to-only-display-unique-values-of-a-field/370081/9 "2024-11-08T12:46:45Z")

</div>

Thanks again @stephenb

So I've used what was in my screenshot above (ie "top values") and when I inspect the graph, I see that the following request is made (I'm just showing the aggregations part):

```auto
 "aggs": {
    "0": {
      "terms": {
        "field": "distribution.instanceId",
        "order": {
          "0-orderAgg": "desc"
        },
        "size": 5,
        "shard_size": 25
      },
      "aggs": {
        "1": {
          "date_histogram": {
            "field": "date.current",
            "calendar_interval": "1w",
            "time_zone": "Europe/Paris",
            "extended_bounds": {
              "min": 1654095295706,
              "max": 1730908914940
            }
          },
          "aggs": {
            "2": {
              "max": {
                "field": "users.total"
              }
            }
          }
        },
        "0-orderAgg": {
          "cardinality": {
            "field": "distribution.instanceId"
          }
        }
      }
    }

```

That looks quite different from the agg I had posted above.

> [@stephenb](#):
>
> can you share the result of the agg query above...

Full query:

```auto
URL: https://...domain.../activeinstalls2/installs3/_search?pretty Query:  
{
    "query": {
        "bool": {
               "must" : {
                  "query_string": {
                    "query": "distribution.extension.version:* AND -distribution.extension.version:*rc* AND -distribution.extension.version:*milestone* AND -distribution.instanceId:xxx"
                  }
               },
               "must_not": [
                {
                  "bool": {
                    "filter": [
                      {
                        "wildcard": {
                          "distribution.extension.version": "*SNAPSHOT"
                        }
                      },
                      {
                        "wildcard": {
                          "distribution.extension.id": "*staging"
                        }
                      },
                      {
                        "wildcard": {
                          "distribution.extension.id": "*rc*"
                        }
                      }
                    ]
                  }
                }
              ],
              "filter": [
               {
                   "script" : {
                      "script" : "((doc['date.current'].value.toEpochSecond() - doc['date.first'].value.toEpochSecond()) >= 86400*5)"
                   }
               },
               { "range": {
                        "date.current": {
                          "gte": "now-30d"
                        }
               }
              }]
        }
    },
      "size": 0,
      "fields": [
      {
      "field": "date.current",
      "format": "date_time"
      }],
  "aggs": {
    "by_day": {
      "date_histogram": {
        "field": "date.current",
        "calendar_interval": "week",
        "time_zone": "Europe/Paris"
      },
      "aggs": {
        "instanceId_count": {
          "cardinality": {
            "field": "distribution.instanceId"
          }
        },
        "max": {
          "terms": {
                "field": "distribution.instanceId",
                "size": 2000
            },
            "aggs":{
                "MAX_USERS":{
                    "max": {
                        "field": "users.total"
                    }
                },
                "MAX_DOCS":{
                    "max": {
                        "field": "documents.total"
                    }
                },
                "MAX_WIKIS":{
                    "max": {
                        "field": "wikis.total"
                    }
                }
            }
        },
        "sumusers":{
          "sum_bucket": {
            "buckets_path": "max>MAX_USERS"
          }
        },
        "sumdocs":{
          "sum_bucket": {
            "buckets_path": "max>MAX_DOCS"
          }
        },
        "sumwikis":{
          "sum_bucket": {
            "buckets_path": "max>MAX_WIKIS"
          }
        }
      }
    }
  }
}

```

Results:

```auto
 {
  "took" : 315,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : []
  },
  "aggregations" : {
    "by_day" : {
      "buckets" : [
        {
          "key_as_string" : "2024-10-07T00:00:00.000+02:00",
          "key" : 1728252000000,
          "doc_count" : 22259,
          "max" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 9843,
            "buckets" : [
              {
                "key" : "...key1...",
                "doc_count" : 639,
                "MAX_USERS" : {
                  "value" : 1.0
                },
                "MAX_DOCS" : {
                  "value" : 1391.0
                },
                "MAX_WIKIS" : {
                  "value" : 1.0
                }
              },
              {
                "key" : "...key2...",
                "doc_count" : 468,
                "MAX_USERS" : {
                  "value" : 45.0
                },
                "MAX_DOCS" : {
                  "value" : 1015.0
                },
                "MAX_WIKIS" : {
                  "value" : 1.0
                }
              },
              {
                "key" : "...key3...",
                "doc_count" : 109,
                "MAX_USERS" : {
                  "value" : 145.0
                },
                "MAX_DOCS" : {
                  "value" : 3211.0
                },
                "MAX_WIKIS" : {
                  "value" : 1.0
                }
              },
...

```

FTR we've coded a visualization in XWiki, based on the agg above and the 2 graphs don't look similar for the same period:

In XWiki, based on the query just above:

 ![Screenshot 2024-11-08 at 13.40.58](https://us1.discourse-cdn.com/elastic/original/3X/7/3/7372747856b9787d8247f0cfcb0afebc8dbddf83.png)

In Kibana, based on the Lens you helped me with:

 ![Screenshot 2024-11-08 at 13.43.41](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1ae62bd0e64f0b8f9949776a2fdea08f094f72a.png)

> [@stephenb](#):
>
> I am not sure you will be able to do this in lens.

If I can't do it in Lens, do I need to use a different visualization? Like using Vega (which I'd need to learn ;))?

Thanks again