# Kibana visualisation from SQL query

**URL:** <https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013>\
**Category:** Kibana\
**Created:** [August 6, 2020, 11:32am UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013 "2020-08-06T11:32:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mkapustin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkapustin/32/73444_2.png) [@Mkapustin](https://discuss.elastic.co/u/Mkapustin)\
**Post date:** [August 6, 2020, 11:32am UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013/1 "2020-08-06T11:32:11Z")

</div>

Hello friends! Need help with visualisation in Kibana from sql query:

1. I have the same table from sql query:  
 ![1](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48465fe26f9359596e9c66afebc3b8fe58ac83f1.jpeg)  
I need to group results values by columns of actions values and by Mail ID. In splunk I realise it with chart option ("chart latest(results) as status over mail\_id by actions"):  
 ![2](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9cceb061744192d182b8a8143ff87aa072c71c9d.jpeg)  
How to get something like this in Kibana?
2. With an sql query, I get the difference between two time parameters in milliseconds. How to display this data on the graph on the Y-axis, on the x-axis-the time of data receipt:  
 ![3](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b7bd681e22558266ab4a490368bcc03a52be57fd.jpeg)

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [August 6, 2020, 2:32pm UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013/2 "2020-08-06T14:32:20Z")

</div>

hi @Mkapustin,

Can you add a `group by` clause?

e.g.

```auto
Select MailId, action, last(timestamp)
FROM filebeat
WHERE ...
GROUP BY MailId, action

```

---

<div class="post-metadata">

**Author:** ![Mkapustin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkapustin/32/73444_2.png) [@Mkapustin](https://discuss.elastic.co/u/Mkapustin)\
**Post date:** [August 17, 2020, 10:45am UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013/3 "2020-08-17T10:45:44Z")

</div>

Hi! Yes, I can add a grouping, however, this does not lead to the desired result (screenshot), I need a table of results by steps, as in the attached screenshot from Splunk (first message).

 ![elk5](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a624d38a582480e18a84947e4559246595ed6c15.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2020, 10:45am UTC](https://discuss.elastic.co/t/kibana-visualisation-from-sql-query/244013/4 "2020-09-14T10:45:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.