# Marking few data points with a separate color

**URL:** <https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466>\
**Category:** Kibana\
**Created:** [March 4, 2016, 3:04am UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466 "2016-03-04T03:04:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tallharish](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tallharish](https://discuss.elastic.co/u/tallharish)\
**Post date:** [March 4, 2016, 3:04am UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/1 "2016-03-04T03:04:07Z")

</div>

Hi Everyone,

I have the time-series dataset with the following mapping. I am able to visualize this easily using line chart, where x-axis is timestamp and y-axis is avg cpu\_total. now I am analyzing these data points using a code (outside of ELK), and marking selected data points as outliers. I plan to add this analysis back into the dataset (as a new field (string / float)) and then would like to visualize in a way that outliers are plotted with a separate color. How do I go about this?

{  
"system\_data" : {  
"mappings" : {  
"cpu\_all" : {  
"properties" : {  
"cpu\_sys" : {  
"type" : "float"  
},  
"cpu\_total" : {  
"type" : "float"  
},  
"cpu\_user" : {  
"type" : "float"  
},  
"cpu\_wait" : {  
"type" : "float"  
},  
"rack\_no" : {  
"type" : "string"  
},  
"timestamp" : {  
"type" : "date",  
"format" : "dateOptionalTime"  
}  
}  
}  
}  
}  
}

![](https://us1.discourse-cdn.com/elastic/original/2X/5/55f3d603938c6be05d396f4e259a034ec8420087.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 4, 2016, 4:27am UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/2 "2016-03-04T04:27:05Z")

</div>

You can't currently do that in KB natively, you might be able with Timelion though (but I'm not 100% sure).

---

<div class="post-metadata">

**Author:** ![tallharish](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tallharish](https://discuss.elastic.co/u/tallharish)\
**Post date:** [March 7, 2016, 2:12am UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/3 "2016-03-07T02:12:40Z")

</div>

Thanks Mark. Let me try Timelion.

Meanwhile I was wondering if it is possible to mouse-over a data-point and read value of a certain field from its document? At least that could help for now.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 7, 2016, 2:38am UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/4 "2016-03-07T02:38:20Z")

</div>

You can do that in core KB as well.

---

<div class="post-metadata">

**Author:** ![tallharish](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tallharish](https://discuss.elastic.co/u/tallharish)\
**Post date:** [March 9, 2016, 3:09pm UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/6 "2016-03-09T15:09:11Z")

</div>

Thanks Mark. How can I enable this?

I am currently seeing the following. What am I missing?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/aae6b4794342d411226afd4e50f77021e03009bd.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 11, 2016, 10:51pm UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/7 "2016-03-11T22:51:59Z")

</div>

Oh, you want to read a custom value? You cannot do that, you can only see the value of the field you graphed at that point.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:59pm UTC](https://discuss.elastic.co/t/marking-few-data-points-with-a-separate-color/43466/8 "2017-07-06T13:59:25Z")

</div>