# How to visualize Event Distribution by Daytime? **URL:** \ **Category:** Kibana\ **Created:** [August 16, 2017, 8:56pm UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317 "2017-08-16T20:56:23Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Kevin\_Wiegand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_wiegand/32/19436_2.png) [@Kevin\_Wiegand](https://discuss.elastic.co/u/Kevin_Wiegand)\ **Post date:** [August 16, 2017, 8:56pm UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/1 "2017-08-16T20:56:23Z")
I hope I'm able to describe my problem... i'm monitoring a system where students can login to register for exams. Now it would be interesting to do a visualisation which show at which daytime how many students try to login to the system. This would help to figure out the relation between logins and other occuring errors. So i need a Timeline with a 24h X-Axis and showing the amount of logins on the y-axis. I dont care about on which day the login were made..only the distribution on the daytime. Thanks for your help! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 16, 2017, 9:06pm UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/2 "2017-08-16T21:06:45Z")
Have a look at [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/\_use\_of\_a\_script\_to\_aggregate\_by\_day\_of\_the\_week.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/_use_of_a_script_to_aggregate_by_day_of_the_week.html) ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [August 17, 2017, 12:06am UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/3 "2017-08-17T00:06:51Z")
Since this post is in Kibana channel, I'll show Mark's solution in Kibana. First create a scripted field in Kibana on your index pattern something like this; `LocalDateTime.ofInstant(Instant.ofEpochMilli(doc['@timestamp'].value.millis), ZoneId.of('US/Central')).getHour()` where `@timestamp` is the date type field my index is based on and `US/Central` is my time zone. You could use a simpler scripted field like `doc["@timestamp"].date.hourOfDay` but it would show the hours in UTC time. ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0758d28f6b47a328d5c04663b50e797424af4d1.png) My data shown here in Discover is daily periodic; ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa6c06fc66b3227f55f19eef5c5c64b148040cd6.png) Now I can create a heatmap visualization over a period of a week, or as long as I want and see the hourly trend per day; ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c67167722331bb271dd106da9026b5c77868e689.png) ---
**Author:** ![Kevin\_Wiegand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_wiegand/32/19436_2.png) [@Kevin\_Wiegand](https://discuss.elastic.co/u/Kevin_Wiegand)\ **Post date:** [August 17, 2017, 10:27am UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/5 "2017-08-17T10:27:23Z")
Thank you very much for your help but here are my experience with your solution: When i try to use: `LocalDateTime.ofInstant(Instant.ofEpochMilli(doc['@timestamp'].value.millis), ZoneId.of('US/Central')).getHour()` Everytime i click on **Discovery** Tab Kibana showed a warning like this and no search results: `Courier fetch: 5 of 50 Shards failed` Also elasticsearch.log tells me: `Caused by: java.lang.IllegalArgumentException: Unable to find dynamic field [millis] for class [java.lang.Long]` After some Research i found many issues with the Threadpoolsize in relation to the `Courier fetch..`-Error, so i tried to set: thread\_pool.search.queue\_size: 100000 As a result my instance of ElasticSearch was broken and i can't get it to restart. So I deleted the new setting in elasticsearch.yml and modified the scripted field and used your second suggestion. This worked without any Errors but as you said it shows the hour in UTC. Finally i found another suggestions which seems to work and differes just a bit from yours: `LocalDateTime.ofInstant(Instant.ofEpochMilli(doc['@timestamp'].value), ZoneId.of('Asia/Shanghai')).getHour()` ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45802207b91a69386c9a418e03e7165e06ff3480.png) ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [August 17, 2017, 8:15pm UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/6 "2017-08-17T20:15:38Z")
Sorry about that. The `.millis` is needed to fix it on the upcoming 6.0 release. But if you're on a 5.x release you should leave it off. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 18, 2017, 9:27am UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/7 "2017-08-18T09:27:28Z")
As usual, @LeeDr is amazing 😃 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2017, 9:27am UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317/8 "2017-09-15T09:27:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.