# JSON Input Help w/ Kibana data table

**URL:** <https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025>\
**Category:** Kibana\
**Created:** [July 21, 2015, 9:13pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025 "2015-07-21T21:13:16Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mrc0113](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\
**Post date:** [July 21, 2015, 9:13pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/1 "2015-07-21T21:13:16Z")

</div>

I'm using a data table in Kibana4 and am trying to achieve the following:  
We are using logstash to retrieve events and I have one field in elasticsearch that marks an event as a transaction starting, success or failure. I already split my table by timestamp, and split my rows by application, but I can't seem to figure out how to get 3 metrics on one row that filter on that field. Is that possible using the JSON Input or another way?

> @timestamp for day 1  
> AppName TransactionCount SuccessCount FailCount  
> app1 1000 995 5  
> app2 2000 1900 100  
> app3 123 123 0

> @timestamp for day 2  
> AppName TransactionCount SuccessCount FailCount  
> app1 1000 995 5  
> app2 2000 1900 100  
> app3 123 123 0

---

<div class="post-metadata">

**Author:** ![Mrc0113](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\
**Post date:** [July 22, 2015, 4:23pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/2 "2015-07-22T16:23:21Z")

</div>

Anyone have any ideas? Is this something that the JSON Input could be used for?

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 22, 2015, 4:58pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/3 "2015-07-22T16:58:51Z")

</div>

Could you post screenshots of what you currently have and a sketch of what you're trying to achieve?

---

<div class="post-metadata">

**Author:** ![Mrc0113](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\
**Post date:** [July 22, 2015, 9:02pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/4 "2015-07-22T21:02:08Z")

</div>

Tanya,

We want to be able to have one row per service with a column that shows the count of messages received, processed, or not processed due to error. The msg\_status field holds the value of "received, processed or error" and that is what we are trying to count.

This is what we currently have - as you can see it creates a separate line per msg\_status (note that there were no errors in this time frame but I don't have good data at this time)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0dced5a05a5728778d2f59a008c2def58eaaaa39.png)

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 28, 2015, 5:16am UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/5 "2015-07-28T05:16:50Z")

</div>

Hi - Sorry about the delay in the response. This is an interesting use case. I don't think there is a way to do this out-of-the box with Kibana today. That's not to say that we couldn't....

Would you mind logging an issue in Github with your use case and suggested enhancement? [https://github.com/elastic/kibana/issues](https://github.com/elastic/kibana/issues)

---

<div class="post-metadata">

**Author:** ![Mrc0113](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\
**Post date:** [July 28, 2015, 1:59pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/6 "2015-07-28T13:59:11Z")

</div>

@tbragin I logged the issue here: [https://github.com/elastic/kibana/issues/4506](https://github.com/elastic/kibana/issues/4506)  
Please feel free to add more information if you think it will help and thanks for your assistance on this.

---

<div class="post-metadata">

**Author:** ![mvenkat\_in](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\
**Post date:** [June 5, 2016, 11:46pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/7 "2016-06-05T23:46:29Z")

</div>

May I know the status of this.. When is this feature expected to be available !!  
There are so many use cases which require this feature.

Thanks  
Venaktesh

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [January 18, 2017, 11:30pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/8 "2017-01-18T23:30:59Z")

</div>

I know this is quite old, and we've all grown up and had kids now, 😉 but I posted a solution last December that might be applicable here (WARNING it might not perform well on very large sets of data).

Basically you create a new scripted field for each of your "statuses" and set them to 1 if they match the name of that status. See;

> [@Datatable config case help](https://discuss.elastic.co/t/datatable-config-case-help/68123/2):
>
> Hi Joodies, I'm guessing a and b are values of type and new, wip, and done are values of status So you're trying to create a data table with terms across the top and down the side. Unfortunately Kibana can't do that (yet). But I came up with a hack of a work-around. I create test data using the Dev Tools console like this; PUT index1/type1/1 { "type": "a", "status": "new" } PUT index1/type1/2 { "type": "a", "status": "wip" } PUT index1/type1/3 { "type": "b", "status": "new" …

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:33pm UTC](https://discuss.elastic.co/t/json-input-help-w-kibana-data-table/26025/9 "2017-07-06T13:33:24Z")

</div>


