# Kibana - Line Graph - Time Aggregation

**URL:** <https://discuss.elastic.co/t/kibana-line-graph-time-aggregation/369885>\
**Category:** Kibana\
**Created:** [October 31, 2024, 5:00pm UTC](https://discuss.elastic.co/t/kibana-line-graph-time-aggregation/369885 "2024-10-31T17:00:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [October 31, 2024, 5:00pm UTC](https://discuss.elastic.co/t/kibana-line-graph-time-aggregation/369885/1 "2024-10-31T17:00:53Z")

</div>

Hello,

I have this line graph.  
It looking at @timestamp and counting the records.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc5bf3e5c3d78cb3fc57c9be2063044ba5bd7725.png)

I was asked if there is a way to do an aggregation of the graph by showing only records after 4pm, and allowing to see that through days. Is that possible?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 31, 2024, 5:59pm UTC](https://discuss.elastic.co/t/kibana-line-graph-time-aggregation/369885/2 "2024-10-31T17:59:52Z")

</div>

Do you mean every day after 4PM? So Monday after 4PM, Tuesday after 4PM, etc...?

If so, you need to add a field like `"after4pm": true` in your documents.  
Ideally, you should compute that at index time. You can use an ingest pipeline for that with a script processor.

Slower idea, if this is not something that you want to run constantly, you could create a runtime field. This could be done from the data view. And create a new field named `after4pm` and emit `true` if the hour of the day is greater or equal to 16.

Another solution is to do that with ES|QL with something like:

```auto
ROW a = DATE_PARSE("yyyy-MM-dd HH:mm:ss", "2024-10-31 17:00:00")
| EVAL hourOfDay = DATE_EXTRACT("HOUR_OF_DAY", a)
| WHERE hourOfDay >= 16

```

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [October 31, 2024, 9:50pm UTC](https://discuss.elastic.co/t/kibana-line-graph-time-aggregation/369885/3 "2024-10-31T21:50:30Z")

</div>

Thanks @dadoonet  
Very helpful !