# How to use Lens to visualize/consider monitors down in a row

**URL:** <https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966>\
**Category:** Synthetics\
**Tags:** kql-kibana-query-language\
**Created:** [November 23, 2021, 3:47pm UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966 "2021-11-23T15:47:32Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [November 23, 2021, 3:47pm UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/1 "2021-11-23T15:47:32Z")

</div>

Hey there,  
I am trying to use Lens to visualize Heartbeat monitors _down_ in a row.  
For example, I try to create a table to get the % values of service _down_ in a specific time interval;  
every Heartbeat check will run every 5 minutes but I will consider the service _down_ only after 3 errors in a row. is it possible to do that?

Currently, this is my table  
 ![Screenshot 2021-11-23 at 16.42.39](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1c78fb8fded74c64d9796a10d36de3d8ab9b918.png)

and this is the used kql :  
`count(kql='monitor.status : "up" ') / count()`

I am facing the same problem also using a time series visualization. I would not see the annotation at the first _down_ event; I would like to see it after 3.

---

<div class="post-metadata">

**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\
**Post date:** [November 23, 2021, 8:10pm UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/2 "2021-11-23T20:10:00Z")

</div>

Hi @rschirin - thanks for your interest in querying Heartbeat data.

Unfortunately there's no easy way to do this out-of-the-box. Our team has had similar challenges when discussing features like this for the Uptime application. We typically focus on overall number down within a given span, rather than tracking individual ordering of pings. For example, that's how the [query](https://github.com/elastic/kibana/blob/main/x-pack/plugins/uptime/server/lib/requests/get_monitor_status.ts#L63) responsible for tracking [monitor status rule](https://www.elastic.co/guide/en/observability/7.15/monitor-status-alert.html)s/alerting works.

It might be possible to do this using a custom [scripted metric aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-scripted-metric-aggregation.html), but that [would not be easy to visualize](https://discuss.elastic.co/t/visualizing-scripted-metric-aggregations-in-kibana/217258/3).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2021, 8:10pm UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/3 "2021-12-17T20:10:03Z")

</div>

This topic was automatically closed 24 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\
**Post date:** [January 3, 2022, 11:01am UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/4 "2022-01-03T11:01:40Z")

</div>

Hello @rschirin ,

It might be possible if you only have one heartbeat location, it get's complex if you want to accumulate results from multiple locations, let me know if you use-case is only limited to one location, i can guide you on how to do that in Lens.

Regards

---

<div class="post-metadata">

**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\
**Post date:** [January 3, 2022, 11:02am UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/5 "2022-01-03T11:02:19Z")

</div>



---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [January 3, 2022, 11:07pm UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/6 "2022-01-03T23:07:48Z")

</div>

Hi @shahzad31, I am really interested to do that. It is ok also with heartbeat from one location. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:33am UTC](https://discuss.elastic.co/t/how-to-use-lens-to-visualize-consider-monitors-down-in-a-row/289966/7 "2022-11-04T08:33:06Z")

</div>


