Kibana table visualisation with columns from different docs

Elastic Stack Kibana
1

I am trying to make a visualisation in Kibana where the row will represent an indexed monthly counting and the columns will show aggregations from different documents.

I index some statistics on the end of each month into a single index. Each document has a field telling what is this particular statistic about. In simple form it can be shown as four documents as follows:

"hits": [
  {
    "_index": "tomasz_a",
    "_type": "doc",
    "_id": "1",
    "_score": 1,
    "_source": {
      "analysis_tag": "decode",
      "timestamp": "2019-02-01T00:00:00.000Z",
      "count": 11
    }
  },
  {
    "_index": "tomasz_a",
    "_type": "doc",
    "_id": "vUU5JWkBWsERaXgE_I_A",
    "_score": 1,
    "_source": {
      "analysis_tag": "decode",
      "timestamp": "2019-02-01T00:00:00.000Z",
      "count": 12
    }
  },
  {
    "_index": "tomasz_a",
    "_type": "doc",
    "_id": "NkVjJWkBWsERaXgEfuWy",
    "_score": 1,
    "_source": {
      "analysis_tag": "reception",
      "timestamp": "2019-02-01T00:00:00.000Z",
      "count": 14
    }
  },
  {
    "_index": "tomasz_a",
    "_type": "doc",
    "_id": "_create",
    "_score": 1,
    "_source": {
      "analysis_tag": "decode",
      "timestamp": "2019-02-01T00:00:00.000Z",
      "count": 13
    }
  }
]

I would like to make a table in the form:

Timestamp | Reception | Decode
2019-01-01 | 18 | 16
2019-02-02 | 14 | 17

I am using Kibana -> Visualize -> Data Table choosing metric: Top Hits.
I can figure out how to split columns to make this table represent only particular fields values.

I am also trying to make it with painless language in JSON field on buckets but no luck so far :frowning:

Can anyone advise how to do it?
Is there any better approach to make such visualisation?

2

There's no clean way to do this at the moment, you can do a date histogram and then split by terms, but it won't give this structure.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.