# How to visualize aggregation

**URL:** <https://discuss.elastic.co/t/how-to-visualize-aggregation/134992>\
**Category:** Kibana\
**Created:** [June 7, 2018, 12:59pm UTC](https://discuss.elastic.co/t/how-to-visualize-aggregation/134992 "2018-06-07T12:59:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Palkos](https://avatars.discourse-cdn.com/v4/letter/p/958977/32.png) [@Palkos](https://discuss.elastic.co/u/Palkos)\
**Post date:** [June 7, 2018, 12:59pm UTC](https://discuss.elastic.co/t/how-to-visualize-aggregation/134992/1 "2018-06-07T12:59:34Z")

</div>

Hi there

I am currently working on experimental project to monitor the logs from remote devices. As part of that the devices report the software version they currently run on. What I need is a dashboard to display as pie chart the distribution of software versions across the devices install base.

I managed to compose the DSL query that gives me the latest record per device serial number containing the message with the version number using aggregations:

{  
"size": 0,  
"query": {  
"match\_phrase": {  
"Message": "Assembly Version"  
}  
},  
"aggs": {  
"SerialNumbers": {  
"terms": {  
"field": "SerialNumber.keyword",  
"size": 100  
},  
"aggs": {  
"LatestRecord": {  
"top\_hits": {  
"size": 1,  
"sort": [  
{  
"TimeStamp": {  
"order": "desc"  
}  
}  
]  
}  
}  
}  
}  
}  
}

Now, that works fine in the dev tool tab but how can I turn it into saved search and how to do it in a way that it is actually the aggregation section that is returned as a result not the documents that took part in "match" section. Is there any way to visualize the aggregation results at all?

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [June 7, 2018, 6:13pm UTC](https://discuss.elastic.co/t/how-to-visualize-aggregation/134992/2 "2018-06-07T18:13:12Z")

</div>

Hi @Palkos,

You should be able to make a [Saved Search](https://www.elastic.co/guide/en/kibana/current/save-open-search.html) matching the phrase `Assembly Version`. Then, make a visualization using that saved search with a configuration something like:

 ![14%20PM](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8fd42cf28d6e3a2310dc1f5f52dffad2eae14fef.png)

---

<div class="post-metadata">

**Author:** ![Palkos](https://avatars.discourse-cdn.com/v4/letter/p/958977/32.png) [@Palkos](https://discuss.elastic.co/u/Palkos)\
**Post date:** [June 8, 2018, 9:36am UTC](https://discuss.elastic.co/t/how-to-visualize-aggregation/134992/3 "2018-06-08T09:36:25Z")

</div>

Hi Chris,

Thanks for the response. Unless I misunderstood something I have a suspicion that would only work if my index contained only the latest software version records. But my index contains the entire timeline of logs so I use the aggregation as per query above to find the latest log per device serial number that contains the "Assembly Version" phrase. And I need to visualize output of that.

Any hints?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2018, 9:36am UTC](https://discuss.elastic.co/t/how-to-visualize-aggregation/134992/4 "2018-07-06T09:36:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.