# Kibana visualization for a nested Cardinality aggregation

**URL:** <https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284>\
**Category:** Kibana\
**Tags:** vega\
**Created:** [June 15, 2022, 1:50pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284 "2022-06-15T13:50:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [June 15, 2022, 1:50pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/1 "2022-06-15T13:50:03Z")

</div>

Hi,

I'm trying to create a visualization for the following query:

```auto
GET _search
{
     "query": {
        "query_string": {
           "query": "distribution.extension.id:org.xwiki.* AND date.since:[1 TO *]"
        }
     },
    "aggs": {
        "activeinstalls_over_time" : {
            "date_histogram" : {
                "field" : "date.current",
                "calendar_interval": "week"
            },
            "aggs" : {
                "instanceId_count" : {
                    "cardinality" : {
                        "field" : "distribution.instanceId"
                    }
                }
            }
        }
    }
}

```

I've found the "Aggregation-based" visualization type but I can't figure out how to add a nested Cardinality aggregation (nor how to set a query string).

When I try to add a nested aggregation, I don't see a Cardinality sub-aggregation available.

 ![Screenshot 2022-06-15 at 15.47.31](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83936f4b8f2771d177bfd90f40a5759cfa6a5763.jpeg)

Any idea what I can do? Do I have to learn how to write a custom visualization using Vega?

Thanks!

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [June 15, 2022, 3:02pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/2 "2022-06-15T15:02:17Z")

</div>

I believe Lens can make this sort of request automatically. Here's my config -

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85f991401ea30ca3857906c67041127731b4263f.png)

and the request (which looks similar to yours)

```auto
{
  "aggs": {
    "0": {
      "terms": {
        "field": "host.os.name",
        "order": {
          "2": "desc"
        },
        "size": 3
      },
      "aggs": {
        "1": {
          "date_histogram": {
            "field": "@timestamp",
            "fixed_interval": "30s",
            "time_zone": "America/New_York",
            "extended_bounds": {
              "min": 1655304231774,
              "max": 1655305131774
            }
          },
          "aggs": {
            "2": {
              "cardinality": {
                "field": "agent.id"
              }
            }
          }
        },
        "2": {
          "cardinality": {
            "field": "agent.id"
          }
        }
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [June 16, 2022, 8:58am UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/3 "2022-06-16T08:58:28Z")

</div>

@ghudgins thanks! I think I got it to work simply with the following:

 ![Screenshot 2022-06-16 at 10.57.44](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38b5db3fe3d231126e22178ab3b0583703d0e44e.png)

---

<div class="post-metadata">

**Author:** ![vmassol](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vmassol/32/17398_2.png) [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Post date:** [June 16, 2022, 9:19am UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/4 "2022-06-16T09:19:43Z")

</div>

hmm thinking about it, I don't think it's correct since I don't see how it would do an aggregation (except for the unique\_count which should correspond to the Cardinality aggregation I suppose) 🙂

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [June 16, 2022, 4:13pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/5 "2022-06-16T16:13:09Z")

</div>

> except for the unique\_count which should correspond to the Cardinality aggregation I suppose

Yes - FWIW unique count is cardinality under the hood.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2022, 4:13pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-a-nested-cardinality-aggregation/307284/6 "2022-07-14T16:13:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.