# Kibana3 histogram markes **URL:** \ **Category:** Elasticsearch\ **Created:** [February 6, 2014, 7:15am UTC](https://discuss.elastic.co/t/kibana3-histogram-markes/15636 "2014-02-06T07:15:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Vaclav\_Adamec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaclav_adamec/32/44787_2.png) [@Vaclav\_Adamec](https://discuss.elastic.co/u/Vaclav_Adamec)\ **Post date:** [February 6, 2014, 7:15am UTC](https://discuss.elastic.co/t/kibana3-histogram-markes/15636/1 "2014-02-06T07:15:30Z")
Hi, I would like to humbly ask for some example how to use markers in Kibana3 histograms as I unable to get it run. What I unsuccessfully tried is bellow, definitely I miss something. Thanks curl -XPUT '[http://localhost:9200/ossec-logstash-2014.02.05/deploy/1](http://localhost:9200/ossec-logstash-2014.02.05/deploy/1)' -d '{ "timestamp" : "2014-02-05T12:00:00", "message" : "Security scans", "tag" : "marks" }' via head plugin query search I can get it: {"query":{"bool":{"must":[{"term":{"deploy.tags":"marks"}}],"must\_not":[],"should":[]}},"from":0,"size":50,"sort":[],"facets":{}} \_index \_type \_id ▼ \_score timestamp message tags ossec-logstash-2014.02.05 deploy 1 12.396167 2014-02-04T 12:00:00 Security scans marks but in Kibana I don't see any marks (even If I tried to query just deploy.tags I have empty result in Kibana), in histogram query: "size": 10, "query": { "filtered": { "query": { "query\_string": { "query": "deploy.tags:"marks"" } }, "filter": { "bool": { "must": [ { "range": { "@timestamp": { "from": 1391497422132, "to": "now" } } } ] } } } }, "sort": [ { "@timestamp": { "order": "desc" } }, Marker setup in histogram: Markeer query: deploy.tags:"marks" Tooltip field: @message Sort: @timestamp -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2425cab4-01a7-48ab-bf7d-9bf0aff95c8f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2425cab4-01a7-48ab-bf7d-9bf0aff95c8f%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Binh\_Ly](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@Binh\_Ly](https://discuss.elastic.co/u/Binh_Ly)\ **Post date:** [February 6, 2014, 2:01pm UTC](https://discuss.elastic.co/t/kibana3-histogram-markes/15636/2 "2014-02-06T14:01:07Z")
Vaclav: This works fine for me. Can you please verify that the field names match correctly. In your example below, the document has a field "tag" but your marker query is using deploy."tags". Just double check to see that everything matches. Also if it still doesn't work, try just using "tag" in the marker query, like for example tag:marks. Other than that I see there is a range filter on your timestamp field so double check to make sure it is actually matching documents in that range that have values for tag. On Thursday, February 6, 2014 2:15:30 AM UTC-5, Vaclav Adamec wrote: > Hi, > I would like to humbly ask for some example how to use markers in Kibana3 > histograms as I unable to get it run. What I unsuccessfully tried is > bellow, definitely I miss something. Thanks > > curl -XPUT '[http://localhost:9200/ossec-logstash-2014.02.05/deploy/1](http://localhost:9200/ossec-logstash-2014.02.05/deploy/1)' -d > '{ > "timestamp" : "2014-02-05T12:00:00", > "message" : "Security scans", > "tag" : "marks" > }' > > via head plugin query search I can get it: > > {"query":{"bool":{"must":[{"term":{"deploy.tags":"marks"}}],"must\_not":,"should":}},"from":0,"size":50,"sort":,"facets":{}} > > \_index > \_type > \_id > ▼ > \_score > timestamp > message > tags > > ossec-logstash-2014.02.05 > deploy > 1 > 12.396167 > 2014-02-04T 12:00:00 > Security scans > marks > > but in Kibana I don't see any marks (even If I tried to query just > deploy.tags I have empty result in Kibana), in histogram query: > > "size": 10, > "query": { > "filtered": { > "query": { > "query\_string": { > "query": "deploy.tags:"marks"" > } > }, > "filter": { > "bool": { > "must": [ > { > "range": { > "@timestamp": { > "from": 1391497422132, > "to": "now" > } > } > } > ] > } > } > } > }, > "sort": [ > { > "@timestamp": { > "order": "desc" > } > }, > > Marker setup in histogram: > > Markeer query: deploy.tags:"marks" > Tooltip field: @message > Sort: @timestamp -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/799fc859-e55e-4fdf-8800-d3467e5790d3%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/799fc859-e55e-4fdf-8800-d3467e5790d3%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Vaclav\_Adamec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaclav_adamec/32/44787_2.png) [@Vaclav\_Adamec](https://discuss.elastic.co/u/Vaclav_Adamec)\ **Post date:** [February 7, 2014, 9:53am UTC](https://discuss.elastic.co/t/kibana3-histogram-markes/15636/3 "2014-02-07T09:53:35Z")
Thanks for reply, actually If I copy whole search query from histogram (Kibana3 - Inspect) and run it in shell I get results, but not getting anything in graph itself - [Ossec histogram query · GitHub](https://gist.github.com/VAdamec/8859892) result is: { "took" : 5, "timed\_out" : false, "\_shards" : { "total" : 96, "successful" : 96, "failed" : 0 }, "hits" : { "total" : 11, "max\_score" : 1.0, "hits" : [ { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "7", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-05T16:00:00", "message" : "QUALYS internal linux system", "tags" : "marks" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "8", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-06T8:30:00", "message" : "QUALYS internal linux system", "tag" : "marks" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "S94z2ZE3QKOWFJTk4sH1dw", "\_score" : 1.0, "\_source" : {"query\_string" : { "query": "deploy\_tags:"marks""}} }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "2C78qfQ8SnauY98Z-z\_g5A", "\_score" : 1.0, "\_source" : {"query\_string" : { "query": "deploy\_tags:"marks""}} }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "3", "\_score" : 1.0, "\_source" : { "message" : "QUALYS internal linux system" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "4", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-04T12:00:00", "message" : "QUALYS internal linux system" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "5", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-03T12:00:00", "message" : "QUALYS external linux system" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "OfW9bP-ySsO4Vdi5CXIrHQ", "\_score" : 1.0, "\_source" : {"query\_string" : { "query": "\_type:deploy"}} }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "6", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-04T12:00:00", "message" : "QUALYS internal linux system", "tags" : "marks" } }, { "\_index" : "ossec-logstash-2014.02.05", "\_type" : "deploy", "\_id" : "1", "\_score" : 1.0, "\_source" : { "timestamp" : "2014-02-05T12:00:00", "message" : "QUALYS internal linux system", "tag" : "marks" } } ] } } On Thu, Feb 6, 2014 at 3:01 PM, Binh Ly [binh@hibalo.com](mailto:binh@hibalo.com) wrote: > Vaclav: > > This works fine for me. Can you please verify that the field names match > correctly. In your example below, the document has a field "tag" but your > marker query is using deploy."tags". Just double check to see that > everything matches. Also if it still doesn't work, try just using "tag" in > the marker query, like for example tag:marks. Other than that I see there > is a range filter on your timestamp field so double check to make sure it > is actually matching documents in that range that have values for tag. > > On Thursday, February 6, 2014 2:15:30 AM UTC-5, Vaclav Adamec wrote: > > > Hi, > > I would like to humbly ask for some example how to use markers in > > Kibana3 histograms as I unable to get it run. What I unsuccessfully tried > > is bellow, definitely I miss something. Thanks > > > > curl -XPUT '[http://localhost:9200/ossec-logstash-2014.02.05/deploy/1](http://localhost:9200/ossec-logstash-2014.02.05/deploy/1)' -d > > '{ > > "timestamp" : "2014-02-05T12:00:00", > > "message" : "Security scans", > > "tag" : "marks" > > }' > > > > via head plugin query search I can get it: > > > > {"query":{"bool":{"must":[{"term":{"deploy.tags":"marks"}} > > ],"must\_not":,"should":}},"from":0,"size":50,"sort":,"facets":{}} > > > > \_index > > \_type > > \_id > > ▼ > > \_score > > timestamp > > message > > tags > > > > ossec-logstash-2014.02.05 > > deploy > > 1 > > 12.396167 > > 2014-02-04T 12:00:00 > > Security scans > > marks > > > > but in Kibana I don't see any marks (even If I tried to query just > > deploy.tags I have empty result in Kibana), in histogram query: > > > > "size": 10, > > "query": { > > "filtered": { > > "query": { > > "query\_string": { > > "query": "deploy.tags:"marks"" > > } > > }, > > "filter": { > > "bool": { > > "must": [ > > { > > "range": { > > "@timestamp": { > > "from": 1391497422132, > > "to": "now" > > } > > } > > } > > ] > > } > > } > > } > > }, > > "sort": [ > > { > > "@timestamp": { > > "order": "desc" > > } > > }, > > > > Marker setup in histogram: > > > > Markeer query: deploy.tags:"marks" > > Tooltip field: @message > > Sort: @timestamp > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/VD1J5g127Wc/unsubscribe](https://groups.google.com/d/topic/elasticsearch/VD1J5g127Wc/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/799fc859-e55e-4fdf-8800-d3467e5790d3%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/799fc859-e55e-4fdf-8800-d3467e5790d3%40googlegroups.com) > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- -- May the fox be with you ... / (~( ) ) /\_/ (_=---_(@ @) ( \ / /|/----|\ V " " " " -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAN1zQ4anCdd4D54ybsjKgjvB5t6axh0F%3DMo1V\_0FqGBX2wNUhg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAN1zQ4anCdd4D54ybsjKgjvB5t6axh0F%3DMo1V_0FqGBX2wNUhg%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:51am UTC](https://discuss.elastic.co/t/kibana3-histogram-markes/15636/4 "2017-07-06T01:51:50Z")