# How to show count values for two x-axis buckets in line charts?

**URL:** <https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903>\
**Category:** Kibana\
**Created:** [February 11, 2019, 5:32pm UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903 "2019-02-11T17:32:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sudhakar\_katakara](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@sudhakar\_katakara](https://discuss.elastic.co/u/sudhakar_katakara)\
**Post date:** [February 11, 2019, 5:32pm UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903/1 "2019-02-11T17:32:16Z")

</div>

We are inserting records in one elastalertic search index(test\_elastalert1) and applying elastalert rules and formulas to find matched records and trigger email for matched ones. These matched records are inserted into other elasticsearch index (elastalert\_status). We have created alias for these two indexes and created one index pattern to use it in visualize to create line chart.

We want to create line chart with showing count as y-axis and get time filed from the test\_elastalert1 for x-axis to display how many events are inserted . Now we want to add sub-buckets to use term(alert\_sent) from elastalert\_status to display how many events are alerted(based on alert\_sent = true). Alert\_sent is Boolean type. Can anyone let me know how to use sub-buckets using Boolean field(alert\_sent :true)?

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [February 14, 2019, 7:18pm UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903/2 "2019-02-14T19:18:58Z")

</div>

Are you not able to run a sub aggregation using terms on alert\_sent? It should be able to split the field up? It sounds like you have the right approach to me.

---

<div class="post-metadata">

**Author:** ![sudhakar\_katakara](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@sudhakar\_katakara](https://discuss.elastic.co/u/sudhakar_katakara)\
**Post date:** [February 15, 2019, 7:55pm UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903/3 "2019-02-15T19:55:13Z")

</div>

as the field is boollean , the count is not displaying properly. Any we are using two dashlets to display the data and compare

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [February 20, 2019, 1:25am UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903/4 "2019-02-20T01:25:09Z")

</div>

I see. Do you only want events where alert\_sent is true? You can filter these out with the search bar at the top instead of bucketing.

`alert_sent: true`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2019, 1:25am UTC](https://discuss.elastic.co/t/how-to-show-count-values-for-two-x-axis-buckets-in-line-charts/167903/5 "2019-03-20T01:25:11Z")

</div>

Closed on March 20, 2019, 1:25am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.