Kibana - Bar graph with stacked counts of attributes

[Skeeve]

I also asked this on stackoverflow but Kibana questions are not often answered there it seems.

I'm puzzled as how this could be done in Kibana.

I have several records each one containing attributes. Something like this:

_id:1, a:0,   b:100
_id:2, a:100, b:0
_id:3, a:100, b:100
_id:4, a:0,   b:0
_id:5, a:0,   b:100

I would like to get a stacked bar graph and I do not know how to achieve this.

It should look similar to this:

5 | XXXX   XXXX  X: 100
  | XXXX   XXXX  #:   0
3 | ####   XXXX 
  | ####   ####    
1 | ####   ####  
  +-------------
     a      b

I hope I could explain what I mean.

[tylersmalley]

Thanks for providing some sample data to work with.

Here it is to use in Dev Tools:

PUT /discuss-202965-a
{
  "settings": {
    "index": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    }
  },
  "mappings": {
    "properties": {
      "a": {
        "type": "integer"
      },
      "b": {
        "type": "integer"
      }
    }
  }
}

PUT /discuss-202965-a/_doc/1
{
  "a": 0,
  "b": 100
}

PUT /discuss-202965-a/_doc/2
{
  "a": 100,
  "b": 0
}

PUT /discuss-202965-a/_doc/3
{
  "a": 100,
  "b": 100
}

PUT /discuss-202965-a/_doc/4
{
  "a": 0,
  "b": 0
}

PUT /discuss-202965-a/_doc/5
{
  "a": 0,
  "b": 100
}

It seems sort of backwards, but to do this you will need to select the line graph. Create two Y-axis, one to sum "a" and the other to sum "b". Then click on "Metrics & Axes" and change both Chart Type's to bar.

If you were to change the data to include the type as a field and create a document per value, we could easily split on them.

PUT /discuss-202965-b
{
  "settings": {
    "index": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    }
  },
  "mappings": {
    "properties": {
      "value": {
        "type": "integer"
      },
      "type": {
        "type": "keyword"
      }
    }
  }
}

POST /discuss-202965-b/_doc
{
  "value": 100,
  "type": "b"
}

POST /discuss-202965-b/_doc
{
  "value": 100,
  "type": "a"
}

POST /discuss-202965-b/_doc
{
  "value": 100,
  "type": "a"
}

POST /discuss-202965-b/_doc
{
  "value": 100,
  "type": "b"
}

POST /discuss-202965-b/_doc
{
  "value": 100,
  "type": "b"
}

[Skeeve]

Thanks for the nice idea. Unfortunately it's not what was asked from me The bars should contain the count of 100s and 0s of a-s and b-s. With your approach I get the sum of a-s and b-s which happen to be, in this case, similar to the count of 100s. But I'm missing the 0s.

It seems I would have to have the data in a different form than I have now in order to properly get the graphs required