# Kibana - date histogram vizualization with unique count per user with login and logout

**URL:** <https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671>\
**Category:** Kibana\
**Created:** [May 14, 2020, 2:55pm UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671 "2020-05-14T14:55:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nuno\_Barros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nuno_barros/32/62143_2.png) [@Nuno\_Barros](https://discuss.elastic.co/u/Nuno_Barros)\
**Post date:** [May 14, 2020, 2:55pm UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671/1 "2020-05-14T14:55:58Z")

</div>

Hi,

I am importing data from a license database into elastic through logstash. The data comes with this structure:

user\_name, timelogin, elapsedtime, timeofrelease

I want to build a visualization with the unique count per user and the difference between the time of login and the time of release of those logins. Indeed, at the end, I need to have a spike with cumulative login sessions that were not released.

I don´t have any ideia how to build such a thing. Anyone of you guys could help me?

The max that i reached it was build a TSVB dashboard with the unique count per user for timelogin and timeofrelease, but without the cumulative for the sessions that was not released.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c909c358279b43c9641b125c3c77c45d5e7e6f8b.png)

---

<div class="post-metadata">

**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\
**Post date:** [May 15, 2020, 12:00am UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671/2 "2020-05-15T00:00:54Z")

</div>

Hello @Nuno_Barros

Welcome to the Elastic discuss forum!

I have few questions:

> [@Nuno\_Barros](#):
>
> user\_name, timelogin, elapsedtime, timeofrelease

Can you have multiple sessions by the same user?

> [@Nuno\_Barros](#):
>
> I want to build a visualization with the unique count per user

Unique count per user of what? Do you want to know the number of sessions per user?

> [@Nuno\_Barros](#):
>
> the difference between the time of login and the time of release of those logins

What does `elapsedtime` represent?

> [@Nuno\_Barros](#):
>
> Indeed, at the end, I need to have a spike with cumulative login sessions that were not released.

How we can identify if a session was not released?

* * *

I think we can help but I think the best option is to share 10 lines with some dummy data and tell us what are the values/calculations you would like to obtain.

Also, as we're talking about a user centric approach, I think the Transform Jobs might help.  
But let's first better frame the problem so we can route you to the best solution.

---

<div class="post-metadata">

**Author:** ![Nuno\_Barros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nuno_barros/32/62143_2.png) [@Nuno\_Barros](https://discuss.elastic.co/u/Nuno_Barros)\
**Post date:** [May 15, 2020, 9:50am UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671/3 "2020-05-15T09:50:23Z")

</div>

Hi @Luca_Belluccini,

Yes, I can have multiple session by the same user on a period of time.

I want to have unique count per user during one hour period because of the billing that is made. (we pay per single user on an hour period and not the multiple sessions made by that user on that period)

Elapsedtime is one field that I wasn't consider on this Approach but can be helpful. Is, in fact, the elapsed time of a session in seconds. I have the timelogin and if you sum the elapsed time you will get the timeofrelease.

If a session was not release, the field timeofrelease will be null. In this case, I have defined a timeout of one hour to all inactive sessions, so the null records were expected to be very small.

I can share some dummy records:

Timelogin;User\_Name;TimeOfRelease;Elapsed\_Time  
2020-05-14 05:36:41.000;user2;2020-05-14 06:50:01.000;4400  
2020-05-14 05:44:03.000;user1;2020-05-14 05:44:04.000;1  
2020-05-14 05:53:06.000;user3;2020-05-14 19:09:48.000;47802  
2020-05-14 06:00:11.000;user1;2020-05-14 06:00:12.000;1  
2020-05-14 06:13:21.000;user4;2020-05-14 07:57:10.000;6229  
2020-05-14 06:13:38.000;user1;2020-05-14 06:13:40.000;2  
2020-05-14 06:14:00.000;user4;2020-05-14 07:57:10.000;6190  
2020-05-14 06:19:42.000;user5;2020-05-14 07:48:27.000;5325  
2020-05-14 06:38:22.000;user6;2020-05-14 07:39:59.000;3697  
2020-05-14 06:39:07.000;user1;2020-05-14 06:39:07.000;0  
2020-05-14 06:46:01.000;user1;2020-05-14 06:46:01.000;0  
2020-05-14 06:46:35.000;user7;2020-05-14 13:25:41.000;23946  
2020-05-14 06:54:58.000;user8;2020-05-14 09:57:43.000;10965  
2020-05-14 06:56:37.000;user9;2020-05-14 07:57:10.000;3633  
2020-05-14 06:56:51.000;user10;2020-05-14 08:06:02.000;4151  
2020-05-14 06:56:58.000;user1;2020-05-14 06:56:59.000;1  
2020-05-14 06:56:59.000;user1;2020-05-14 06:57:00.000;1  
2020-05-14 06:59:43.000;user11;2020-05-14 17:53:24.000;39221

Sorry, because i am not being clear and is a bit difficult to explain.

Basically, we need to build a visualization to show many licences are being used aggregated for  
one hour period and per user and consider the licenses that was not released like a cumulative sum.

Best regards and thank you for helping me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2020, 9:50am UTC](https://discuss.elastic.co/t/kibana-date-histogram-vizualization-with-unique-count-per-user-with-login-and-logout/232671/4 "2020-06-12T09:50:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
