# How to create chart **URL:** \ **Category:** Kibana\ **Created:** [October 7, 2020, 11:52am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261 "2020-10-07T11:52:15Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 7, 2020, 11:52am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/1 "2020-10-07T11:52:16Z")
Hello, I try create chart but ... I have 4 queries: > 1. Messages Sent (Internal) > `"query": "event_id: \"SEND\" AND connector_id: \"Intra-Organization SMTP Send Connector\" AND directionality: \"Originating\""` ![kibana1](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8fb3fdb59d626f9e3c66541d268e4d39d0d69eb8.jpeg) > 1. Messages Sent > `"query": "event_id: \"SEND\" AND connector_id: \"Outbound Internet Mail\""` ![kibana2](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9ede3665129436576440cb9bb5873b1f0479eb2d.jpeg) > 1. Messages Received > `"query": "event_id: \"DELIVER\" AND directionality: \"Incoming\""` ![kibana3](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ffb9d260471fb0c1064dd43d561fab51ac44bd71.jpeg) > 1. Messages Received (Internal) > `"query": "event_id: \"DELIVER\" AND directionality: \"Originating\""` ![kibana4](https://us1.discourse-cdn.com/elastic/original/3X/2/9/295922be2638e556b619ce5eb11ac97a3499dce1.jpeg) I would like to have such cumulative chart like this ![kibana5](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b57672d8f79bc72be1de6d0c4e682e4a40114f97.jpeg) How can I do this? ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 12, 2020, 8:48am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/2 "2020-10-12T08:48:15Z")
Hi @zen.xen, from my understanding you could use Vertical Bar Chart. Your queries seem to be a bit complex so what you need is to create filters aggregation, you can also add custom labels. Here's the example with sample data: ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d6405a5a4660fad7e7c9066f8a2ff13be89d819.png) Btw, I noticed you are using lens to creating your chart – the filters functionality for Lens will appear in the upcoming version 7.10. Let me know if you need further guidance. Marta ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 12, 2020, 10:37am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/3 "2020-10-12T10:37:58Z")
Hello @Marta_Bondyra, your advice is perfect, I have created 4 filters, used Vertical Bar Chart and now my chart looks like I wanted. Thanks for help and have a nice day. ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 13, 2020, 11:50am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/4 "2020-10-13T11:50:00Z")
Hello @Marta_Bondyra, recently you have helped me very much. I need another advice, I tried many combinations but all failed. I have logs from winlogbeat, they look like these ``` Time message winlog.user.name winlog.user_data.Param8 Oct 13, 2020 @ 13:22:23.686 Document 30, Print Document userA 6 Oct 13, 2020 @ 13:10:16.047 Document 29, Print Document userB 1 Oct 13, 2020 @ 13:04:21.049 Document 28, Print Document userC 2 Oct 13, 2020 @ 12:56:23.686 Document 27, Print Document userB 2 Oct 13, 2020 @ 12:54:18.047 Document 26, Print Document userB 1 Oct 13, 2020 @ 12:50:24.049 Document 25, Print Document userC 1 ``` I'd like to get such chart as below ![kibana10](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99016fe8747ee371ed76ea68e023b5f6f1cbeff0.jpeg) Is't possible do something like this in Kibana? ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 13, 2020, 4:12pm UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/5 "2020-10-13T16:12:28Z")
Hi @zen.xen, you have 2 options here - you can either create a lens visualisation with the following setup: ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/8/3888b29b4f58eee68f6a5c4840bb6a2f2affdd96.png) If you know at the beginning how many more or less users you have, remember to slide up the slider clicking on the X-axis 'Top values of user' button. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96ffe9c8d63d084d5896d5ba45d8645e914ea838.png) Second option (this is the option when you don't want to get top values of the field 'winlog.user.name' but only some specific values (like you want to ignore userD which happens to have the most entries and only display values from users A, B and C) is to create filters aggregation vizualization again, just like in the example in my previous answer (count on Y-axis and filters in X-axis ) ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 13, 2020, 5:41pm UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/6 "2020-10-13T17:41:17Z")
Hi @Marta_Bondyra, I don't use lens to create visualization, I don't have x-pack because I use Bitnami ELK stack, I only use Buckets with proper filters like in your previous post. ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 14, 2020, 7:50am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/7 "2020-10-14T07:50:35Z")
@zen.xen instead of filters, you can also use 'terms' aggregation on vertical bar which is equivalent of Lens - it will give top (x) values of a field 'user'. ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 14, 2020, 8:50am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/8 "2020-10-14T08:50:58Z")
after your suggestion I did sth like this ![kibana11](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9a419aa5516e9b581a87f4d8eaca6d29db2fc24.jpeg) but chart shows how many printouts were done by user not how many pages were printed ![kibana12](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cce99184c5eae46dab1e5a05511f2f69c162a2ee.jpeg) ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 14, 2020, 8:54am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/9 "2020-10-14T08:54:42Z")
Not sure what's the structure of your data, but if you have a field, eg. `pages_printed`, instead of Aggregation of 'Count' on Y-axis, use aggregation `sum` of a field you want to sum, so in my example case `pages_printed`. ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 14, 2020, 9:30am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/10 "2020-10-14T09:30:19Z")
Hello, my structure looks like below ```auto Time, message, winlog.user.name = user name winlog.user_data.Param8 = printed pages ``` ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 14, 2020, 2:38pm UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/11 "2020-10-14T14:38:42Z")
So your visualization configuration should like this one: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f43dad743637575a29dd5d77562a06f1c91a641.png) ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 14, 2020, 9:17pm UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/12 "2020-10-14T21:17:23Z")
Hello @Marta_Bondyra, it doesn't work but now I know why. Let me explain, in your example there is one thing, in the **Y-axis** \> **field** there appeared **winlog.user\_data.Param8** , I got flash of insight, I have checked how winlogbeat treats that field, in my case this field is **STRING** type. In Windows there is an Event ID=307 in Microsoft-Windows-PrintService/Operational and this looks sth like this > Document 128, Print Document owned by xxx was printed ...... . **Pages printed** : 2. No user action is required. So, I can't sum how many pages were printed by user. Maybe you know, is it possible to convert string to number in winlogbeat? ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 15, 2020, 7:24am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/13 "2020-10-15T07:24:37Z")
@zen.xen, it would be the easiest if you could ingest the data as number, but the workaround would be to create scripted field and then use scripted field with a script like that: ```auto if (doc['winlog.user_data.Param8'].empty) { return "0" } else { return Double.parseDouble(doc['winlog.user_data.Param8'].value); } ``` To learn more you can look here: [https://www.jtouzi.net/asides/convert-a-field-from-string-to-number-using-painless-in-kibana-elasticsearch/](https://www.jtouzi.net/asides/convert-a-field-from-string-to-number-using-painless-in-kibana-elasticsearch/) about scripted fields: [https://www.pixelite.co.nz/article/how-to-create-scripted-fields-in-kibana/](https://www.pixelite.co.nz/article/how-to-create-scripted-fields-in-kibana/) ---
**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Post date:** [October 15, 2020, 8:52am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/14 "2020-10-15T08:52:23Z")
@Marta_Bondyra, fantastic, it works!!! Now I have what I wanted. thank you very much ---
**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\ **Post date:** [October 15, 2020, 9:04am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/15 "2020-10-15T09:04:03Z")
Great, I am happy I could help you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 12, 2020, 9:04am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261/16 "2020-11-12T09:04:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.