How to create advanced visualization in Kibana?

Hi.
I am new to Kibana and are struggling to find out how to create more "advanced" visualizations.
I have already created a dashboard of more simple metrics and charts, but now i want to take the next step.

My data consists of one event per user which sign in to different clients.
Basically, what i want to do is to count the number of users which has signed in into more than one client the last week.
So it would be something like this:

  1. GROUP all events BY SubjectID (hence one group per unique subjectID)
  2. COUNT all the groups where UNIQUE clientID > 1

How can I do this in a Kibana visualization? What kind of visualization should i use?
In advance, thanks for your help!

Hi, this is in fact quite complex visualization and at this moment you can use Vega to achieve it. It would be something like this (example fore ecommerce data):

{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "data": {
    "url": {
      "%context%": true,
      "index": "kibana_sample_data_ecommerce",
      "body": {
        "aggs": {
          "groupedCategories": {
            "terms": {"field": "category.keyword", "size": 100000}, //GROUP all doc BY category.keyword 
            "aggs": {
              "uid": {"cardinality": {"field": "customer_id"}}, // COUNT all the groups with customer_id cardinality
              "sales_bucket_filter": {
                "bucket_selector": {
                  "buckets_path": {"uniqueCustomerId": "uid"},
                  "script": "params.uniqueCustomerId > 20" // where unique customerId > 20 (replace with 1 in your case)
                }
              },
              "counter": {
                "bucket_script": {"buckets_path": "uid", "script": "return 1"} // count the remaining groups
              }
            }
          },
          "count": {"sum_bucket": {"buckets_path": "groupedCategories>counter"}} // pass to the result
        },
        "size": 0
      }
    },
    "format": {"property": "aggregations.count"}
  },
  "encoding": {"text": {"field": "value", "type": "quantitative"}},
  "mark": { // styling, refer to vega documentation to change it
    "type": "text",
    "fill": "red",
    "fontSize": 100,
    "fillOpacity": 1,
    "x": 10,
    "y": 10
  },
  "config": {"view": {"stroke": "transparent"}}
}

Screenshot 2022-03-24 at 11.08.47

Let me know if that helps, it should work only y replacing the field names I used for your own :slight_smile:

This is working! Thank you so much, really helpful of you!! :slight_smile:

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.