Can anyone provide some advice on how to create a single, stacked histogram based on the following data. At the moment everything I'm trying results in split charts which I'd like to avoid.
My data is time-based events which record when an application starts or stops. I have a number of different applications in my environment.
Records in ES will be created with these fields:
- eventTimestamp: the datetime the application started or stopped
- context: will be one of either "APPLICATION STARTED" or "APPLICATION STOPPED"
- appName: the name of the application
- hostname: the host on which the application was running
Ideally I was hoping to create a grouped date histogram where the data was grouped by appName but the individual bars were stacked to distinguish 'APPLICATION STARTED' events from 'APPLICATION STOPPED' events.
The grouped date histogram bit is fine, but my only option for the next bit appears to be to add a new x-axis sub-bucket of type split-chart, and add two filters on the 'context' field.
Can anyone offer any advice on whether its possible to do this without needing the 'split chart'?