How to create advanced visualization in Kibana?

[ninamarie0]

Hi.
I am new to Kibana and are struggling to find out how to create more "advanced" visualizations.
I have already created a dashboard of more simple metrics and charts, but now i want to take the next step.

My data consists of one event per user which sign in to different clients.
Basically, what i want to do is to count the number of users which has signed in into more than one client the last week.
So it would be something like this:

1. GROUP all events BY SubjectID (hence one group per unique subjectID)
2. COUNT all the groups where UNIQUE clientID > 1

How can I do this in a Kibana visualization? What kind of visualization should i use?
In advance, thanks for your help!

[Marta_Bondyra]

Hi, this is in fact quite complex visualization and at this moment you can use Vega to achieve it. It would be something like this (example fore ecommerce data):

{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "data": {
    "url": {
      "%context%": true,
      "index": "kibana_sample_data_ecommerce",
      "body": {
        "aggs": {
          "groupedCategories": {
            "terms": {"field": "category.keyword", "size": 100000}, //GROUP all doc BY category.keyword 
            "aggs": {
              "uid": {"cardinality": {"field": "customer_id"}}, // COUNT all the groups with customer_id cardinality
              "sales_bucket_filter": {
                "bucket_selector": {
                  "buckets_path": {"uniqueCustomerId": "uid"},
                  "script": "params.uniqueCustomerId > 20" // where unique customerId > 20 (replace with 1 in your case)
                }
              },
              "counter": {
                "bucket_script": {"buckets_path": "uid", "script": "return 1"} // count the remaining groups
              }
            }
          },
          "count": {"sum_bucket": {"buckets_path": "groupedCategories>counter"}} // pass to the result
        },
        "size": 0
      }
    },
    "format": {"property": "aggregations.count"}
  },
  "encoding": {"text": {"field": "value", "type": "quantitative"}},
  "mark": { // styling, refer to vega documentation to change it
    "type": "text",
    "fill": "red",
    "fontSize": 100,
    "fillOpacity": 1,
    "x": 10,
    "y": 10
  },
  "config": {"view": {"stroke": "transparent"}}
}

Let me know if that helps, it should work only y replacing the field names I used for your own

[ninamarie0]

This is working! Thank you so much, really helpful of you!!