Kibana latest value aggregation pie chart

Elastic Stack Kibana
1

Imagine a service reports a user_id and a country on an event of a country change by a user. How possible to chart an aggregation on user count per country, considering that user should be counted towards the current (latest reported for this user_id) country only.

For example, we have the following entries:
// user_id: 1, country: UK, @timestamp: 1
// user_id: 2, country: UK, @timestamp: 2
// user_id: 1, country: USA, @timestamp: 3
// user_id: 3, country: UK, @timestamp: 4

The results should be the following:
// UK: 2
// USA: 1

If it's possible, then how to visualise the result in a pie chart,
If it's not possible, then the bonus question:

Imagine there's a way to report the current country stats into elk, how would you report it in order to get the desired pie chart?

2

Hi,

To get that kind of aggregation in Kibana, you'll want a user-centric index that keeps the last-known country for each user updated as new events are generated. Take a look at a similar question I helped with: Count Of Metric after Doing Top Hits

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.