# How to do a specific Kibana visualization

**URL:** https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237
**Category:** Kibana
**Created:** [June 11, 2019, 4:04pm UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237 "2019-06-11T16:04:03Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)
#### Post date: [June 11, 2019, 4:04pm UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/1 "2019-06-11T16:04:03Z")

</div>

Hello,

I need your help to know if I can do a specific thing.

I have several logs messages has follow:  
ABC\_FILE\_01 -- Received message from abc, assigning ID: 0acf1a1f-9edf-43e1-a929-d711b379604b  
ABC\_CLEANSING\_CM\_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, number: XX received CM quality code for [xxxxx@gmail.com](mailto:xxxxx@gmail.com) is 12345  
ABC\_ING\_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, idG: 11159999 was created

I want to count all messages beginning by "ABC\_ING\_01" where id next to "client:" is existing in a message beginning by "ABC\_FILE\_01".  
ID are unique ID.

Thanks for your help.  
Antoine

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [June 12, 2019, 2:13pm UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/2 "2019-06-12T14:13:53Z")

</div>

What does your [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/mapping.html) look like for the index? How is message broken up into fields?

---

<div class="post-metadata">

### Author: ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)
#### Post date: [June 12, 2019, 3:01pm UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/3 "2019-06-12T15:01:07Z")

</div>

Hello Nathan,

Here is the mapping :  
ABC\_FILE\_01, ABC\_CLEANSING\_CM\_01, ABC\_ING\_01 are saved into field called "logcode".  
Id 0acf1a1f-9edf-43e1-a929-d711b379604b is saved into field called "logid".  
11159999 is saved into field called "groupeId"

All others informations are useless for this usecase.

Thanks for your help.

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [June 12, 2019, 5:37pm UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/4 "2019-06-12T17:37:00Z")

</div>

Using KQL, the query would look something like `logid :* AND logcode : "ABC_ING_01"`

---

<div class="post-metadata">

### Author: ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)
#### Post date: [June 13, 2019, 7:27am UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/5 "2019-06-13T07:27:54Z")

</div>

Hello Nathan,

Thanks for this proposal but with this query I will also count all logid which are not existing in a message beginning by ABC\_FILE\_01.  
Indeed, there are a lot of messages beginning with ABC\_ING\_01 where logid is not existing in a message beginning by ABC\_FILE\_01.

I hope to be clear.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2019, 7:28am UTC](https://discuss.elastic.co/t/how-to-do-a-specific-kibana-visualization/185237/6 "2019-07-11T07:28:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.