Kibana visualisation from SQL query

[Mkapustin (Mikhail)]

Hello friends! Need help with visualisation in Kibana from sql query:

1. I have the same table from sql query:
   
   
   
   I need to group results values by columns of actions values and by Mail ID. In splunk I realise it with chart option ("chart latest(results) as status over mail_id by actions"):
   
   
   
   How to get something like this in Kibana?
2. With an sql query, I get the difference between two time parameters in milliseconds. How to display this data on the graph on the Y-axis, on the x-axis-the time of data receipt:
   
   

[thomasneirynck]

hi @Mkapustin,

Can you add a group by clause?

e.g.

Select MailId, action, last(timestamp)
FROM filebeat
WHERE ...
GROUP BY MailId, action

[Mkapustin (Mikhail)]

Hi! Yes, I can add a grouping, however, this does not lead to the desired result (screenshot), I need a table of results by steps, as in the attached screenshot from Splunk (first message).