I was able to achieve the desired Graph via Vega visualizations available from 6.2+ in Kibana core as an experimental visualization and you can use the plugin if you are running an older version.
The following Vega lite specification draws your desired bar chart:
{
$schema: https://vega.github.io/schema/vega-lite/v2.json
data: {
url: {
%timefield%: @timestamp
%context%: true
index: /events-* [or your index pattern]
body: {
size: 0
aggs: {
users: {
terms: {
field: "user.id"
size: 10000
order: {eventCount: "desc"}
}
aggs: {
eventCount: {
cardinality: {field: "event.id"}
}
}
}
}
}
}
format: {property: "aggregations.users.buckets"}
}
mark: bar
transform: [
{
aggregate: [
{op: "count", field: "key", as: "usercount"}
]
groupby: ["eventCount.value"]
}
]
encoding: {
x: { field: "eventCount\\.value", type: "ordinal", sort: "descending" }
y: { field: "usercount", type: "quantitative" }
}
}
If you make sure the field names are correct, that will do a terms aggregation on the user.id
field and calculate the amount of unique event.id
s each user had.
After that we use Vega's transform
to aggregate all buckets by their eventCount.value
(i.e. the value of the unique count of events), so the result will look like:
[
{ "eventCount.value": 5, usercount: 1 },
{ "eventCount.value": 4, usercount: 3 },
{ "eventCount.value": 3, usercount: 20 }, // ...
]
We'll then just use Vega lite encodings to draw this as a bar chart (or you could of course use any other chart you want). The period in eventCount.value
must be escaped in the encoding, since Vega will otherwise try to find a nested field eventCount: { value: ... }
, but in our case it's just the name of the field containing a period, caused by the groupby aggregation.
Hope that chart is closer to what you are looking for.
Cheers,
Tim