# Kibana query problem **URL:** \ **Category:** Kibana\ **Created:** [July 5, 2023, 12:31pm UTC](https://discuss.elastic.co/t/kibana-query-problem/337671 "2023-07-05T12:31:03Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hanni](https://avatars.discourse-cdn.com/v4/letter/h/ee7513/32.png) [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Post date:** [July 5, 2023, 12:31pm UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/1 "2023-07-05T12:31:03Z")
Hello, I'm currently working with kibana. Currently I have made a visualization that allows me to count the unique host. I have another plugin \_id field But the problem is that I want to be able to count the unique plugin id by unique host. how can I resolve it? ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a795742dbcffe6df402966ce523bffc14ac0e7c8.png) ---
**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\ **Post date:** [July 6, 2023, 6:04am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/2 "2023-07-06T06:04:38Z")
Hey, it is not very clear to me what you want to visualize. If you have as a metric the unique count of plugin\_id and on the breakdown the host? ---
**Author:** ![Hanni](https://avatars.discourse-cdn.com/v4/letter/h/ee7513/32.png) [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Post date:** [July 6, 2023, 9:19am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/3 "2023-07-06T09:19:00Z")
I'll put it in context. I have my risk field that I want to be able to visualize over time. So that's why on the x-axis I have the date field and my risk field in break down. Then, to display my risk field, I want to count the unique plugin id by unique host. And I don't know how to do it ---
**Author:** ![Hanni](https://avatars.discourse-cdn.com/v4/letter/h/ee7513/32.png) [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Post date:** [July 6, 2023, 9:23am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/4 "2023-07-06T09:23:26Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eaac43b9914b6c25e01639dcb33cb772219a20c6.png) I have tried this setting but I want to know how can I aggregate the value. I want to sum all High and all medium in order to have one display of high and one display of medium ---
**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\ **Post date:** [July 6, 2023, 10:12am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/5 "2023-07-06T10:12:01Z")
Hey thanx for the explanation. It seems to me that you want something like this [[Lens] collapse by only one field for multi-field top values · Issue #146733 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/146733). This is not possible atm but I added your use case in the comments. It helps for prioritization. ---
**Author:** ![Hanni](https://avatars.discourse-cdn.com/v4/letter/h/ee7513/32.png) [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Post date:** [July 6, 2023, 10:38am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/6 "2023-07-06T10:38:30Z")
it there a formula that a I can set in advanced settings to have my information? how can I do unique count with kql? ---
**Author:** ![Stratoula\_Kalafateli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stratoula_kalafateli/32/70923_2.png) [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)\ **Post date:** [July 6, 2023, 10:47am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/7 "2023-07-06T10:47:57Z")
KQL is a filtering language, you can't run aggregations. I am afraid what you want is not possible with Lens formulas. ---
**Author:** ![Hanni](https://avatars.discourse-cdn.com/v4/letter/h/ee7513/32.png) [@Hanni](https://discuss.elastic.co/u/Hanni)\ **Post date:** [July 6, 2023, 10:55am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/8 "2023-07-06T10:55:52Z")
I want to be able to have per single host (in each host we make a single plugin id ) the number of risk. so it is not possible with kibana? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 3, 2023, 10:56am UTC](https://discuss.elastic.co/t/kibana-query-problem/337671/9 "2023-08-03T10:56:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.