# Multi Index Visualization
**URL:** https://discuss.elastic.co/t/multi-index-visualization/55666
**Category:** Kibana
**Created:** [July 15, 2016, 11:11pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666 "2016-07-15T23:11:25Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 15, 2016, 11:11pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/1 "2016-07-15T23:11:25Z")
Trying to set up one visualization graph that has several indexes on it.
I have indexes like this:
```
agslx-blabla-varnish
agslx-blabla2-varnish
agslx-blabla3-varnish
```
I've configured Kibana to use: "agslx-\*-varnish" index which didn't throw any errors. Now I want to graph X field from all the indexes in one graph. Example data:
```
{
"@timestamp" => "2016-07-15T23:04:02.948Z",
"type" => "vc_server",
"hostname" => "agslx-hpclavc06",
"MAIN_hit_rate" => 99.66,
"tags" => [
[0] "varnishstat"
]
}
{
"@timestamp" => "2016-07-15T23:04:02.172Z",
"type" => "vc_server",
"hostname" => "agslx-hpclavc05",
"MAIN_hit_rate" => 99.57,
"tags" => [
[0] "varnishstat"
]
}
```
I want to graph the MAX every 1 min of "MAIN\_hit\_rate". What I accomplished so far looks like this but only shows the data from one index: [graph](http://i.imgur.com/gH4uszN.png)
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 17, 2016, 6:15am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/2 "2016-07-17T06:15:21Z")
I don't know if KB supports wildcards in the middle like that, try `agslx-*`?
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 17, 2016, 11:09pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/3 "2016-07-17T23:09:12Z")
Doesn't work either. Still only shows one index even If I have two indexes with the same field name.
[Graph](http://i.imgur.com/3NYM8Od.png)
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 17, 2016, 11:34pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/4 "2016-07-17T23:34:40Z")
That definitely works, it's why the default pattern is `logstash-*`.
What does the mappings for the index look like?
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 18, 2016, 12:32am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/5 "2016-07-18T00:32:06Z")
Here are the mappings for the two indexes:
```
{
"agslx-hpclavc05-varnishstat" : {
"mappings" : {
"vc_server" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
"MAIN_backend_fail" : {
"type" : "double"
},
"MAIN_fetch_1xx" : {
"type" : "double"
},
"MAIN_fetch_204" : {
"type" : "double"
},
"MAIN_fetch_304" : {
"type" : "double"
},
"MAIN_fetch_failed" : {
"type" : "double"
},
"MAIN_hit_rate" : {
"type" : "double"
},
"MAIN_n_lru_nuked" : {
"type" : "double"
},
"MAIN_sess_drop" : {
"type" : "double"
},
"hostname" : {
"type" : "string"
},
"tags" : {
"type" : "string"
},
"type" : {
"type" : "string"
}
}
}
}
}
}
{
"agslx-hpclavc06-varnishstat" : {
"mappings" : {
"vc_server" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
"MAIN_backend_fail" : {
"type" : "double"
},
"MAIN_fetch_1xx" : {
"type" : "double"
},
"MAIN_fetch_204" : {
"type" : "double"
},
"MAIN_fetch_304" : {
"type" : "double"
},
"MAIN_fetch_failed" : {
"type" : "double"
},
"MAIN_hit_rate" : {
"type" : "double"
},
"MAIN_n_lru_nuked" : {
"type" : "double"
},
"MAIN_sess_drop" : {
"type" : "double"
},
"hostname" : {
"type" : "string"
},
"tags" : {
"type" : "string"
},
"type" : {
"type" : "string"
}
}
}
}
}
}
```
I want to display the values of MAIN\_hit\_rate for both indexes on the same graph. Is it in any way possible?
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 20, 2016, 12:21am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/6 "2016-07-20T00:21:05Z")
Any ideas on how to accomplish this? Am I approaching storing the data in a wrong way? How would I go about graphing data from several different servers?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 20, 2016, 1:13am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/7 "2016-07-20T01:13:42Z")
Did you alter the pattern to `agslx-*`?
There's nothing that should be stopping this from being graphed.
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 20, 2016, 1:38am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/8 "2016-07-20T01:38:57Z")
Yes I did alter the pattern to `agslx-*` but I can't find any options on how to graph different indexes. I can only graph the max value from one field but it shows that field from one index instead of all of them.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 20, 2016, 1:44am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/9 "2016-07-20T01:44:45Z")
It'll show it from all applicable indices.
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 20, 2016, 2:44am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/10 "2016-07-20T02:44:00Z")
Look at this image: [graph](http://i.imgur.com/3NYM8Od.png). It shows the index is `agslx-*`. Only graphs from one index in particular instead of both.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 20, 2016, 6:42am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/11 "2016-07-20T06:42:46Z")
How do you know this?
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 20, 2016, 7:08am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/12 "2016-07-20T07:08:07Z")
Because there's only one line there and it's the value from one index only. I'm checking the values with logstash and there are two different ones yet there's only one line there.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 20, 2016, 8:03am UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/13 "2016-07-20T08:03:14Z")
Yeah but your graph is the MAX value from any value in that field, irrespective of the index.
Maybe you are after something else?
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [July 20, 2016, 7:37pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/14 "2016-07-20T19:37:13Z")
Oh I get it now. I graphed the unique count and it shows as "2" so that's working as intended. How would I go about graphing the values of both indexes at once?
Every 1 minute we receive this kind of data:
```
{
"@timestamp" => "2016-07-20T19:35:06.627Z",
"type" => "vc_server",
"hostname" => "agslx-hpclavc05",
"MAIN_hit_rate" => 99.63,
"tags" => [
[0] "varnishstat"
]
}
```
How can I graph the value of MAIN\_hit\_rate regardless of min/max/avg?
I think the easiest approach would be to edit the field and include the hostname to achieve what I want.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 20, 2016, 10:10pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/15 "2016-07-20T22:10:55Z")
KB only shows aggregations of some sort, so it can't show the exact value. It's kinda counterintuitive.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/multi-index-visualization/55666/16 "2017-07-06T13:45:24Z")