# Multiple row metric heat hap

**URL:** <https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392>\
**Category:** Kibana\
**Created:** [September 13, 2018, 12:35am UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392 "2018-09-13T00:35:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![drdavew00](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@drdavew00](https://discuss.elastic.co/u/drdavew00)\
**Post date:** [September 13, 2018, 12:35am UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392/1 "2018-09-13T00:35:23Z")

</div>

I'm trying to achieve the same style of heat map as this post.

> [@Generating matrix heatmap in Kibana](https://discuss.elastic.co/t/generating-matrix-heatmap-in-kibana/94564):
>
> Hi, I want to create a matrix-type heatmap as shown here: [https://github.com/stormpython/heatmap](https://github.com/stormpython/heatmap) Sample image: [image] My X-axis will be date histogram and Y-axis will be the multiple fields being monitored. For e.g. First row could be CPU, second memory and so on. And depending on the ranges specified, the colors can be green, yellow or orange. I could create basic heatmap in Kibana for one field, but couldn't find anything that allows me to create such a grid. The plugin provided in the…

I'm trying to follow the advice in this post, but seem to be missing something.

My data is already counted , so i don't need kibana to do counts for me.

Maybe i'm thinking too much in relational tables, spreadsheets.

I'm ingesting "rows", that have a timestamp field and multiple fields that are floats that are already counts.

I'd like a heat map that has a row for each field that is already counted before ingest by logstash, and my timestamps across the bottom. I would set colors based on my incoming counts.

For example, the data coming in could be failure counts at each station. I'd like a heat map as follows:

Station1 2 0 0 1  
Station2 0 0 0 4  
Station3 4 5 9 8

```
                     11:00h 12:00h 13:00h 14:00h 

```

with ingest data being timestamped csv rows like:

11:00,4,0,2  
12:00,5,0,0  
13:00,9,0,0  
14:00,8,4,1

The 11:00 Logstash ingest would be:

"Station1" =\> 2.0  
"Station2" =\> 0.0  
"Station3" =\> 4.0

Please let me know if this is possible, maybe give some more hints, or pointers to samples, etc.

Everything I've seen in documentation, videos seems to start with kibana counting raw events, but i've already counted the events. My endpoints have smarts, have already done one level of data summation. 😉

Thanks!

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [September 14, 2018, 3:20am UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392/2 "2018-09-14T03:20:45Z")

</div>

The context for Kibana doing the counting is in most cases there's more data than the browser can render, so we use elasticsearch to group all this data together for us. Like you mentioned, Kibana visualizations expect raw events that get grouped into buckets of data, (although there's some work coming down the line with the canvas plugin that can do point series).

The only only way around this I can think of is somewhat imperfect. We still have to group the data by timestamp, and then we can use the top hits metric to give the the most recent value in that bucket. The downside is there may be buckets that have multiple readings and all but one will be ignored.

---

<div class="post-metadata">

**Author:** ![drdavew00](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@drdavew00](https://discuss.elastic.co/u/drdavew00)\
**Post date:** [September 14, 2018, 7:30pm UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392/3 "2018-09-14T19:30:46Z")

</div>

Thanks @jbudz! I appreciate the great help!!

I'm totally fine with using Top Hit, as I likely have one event per interval.

I think what I'm really looking for is an "Add Metric" in the upper section of the configuration panel on the left. So in my case, I'd have one row in the heat map for Station1, and could use Top Hit just fine, then I'd add a metric, for a second row in the heat map for Station2, etc.

Prior guidance suggested using the split chart in the Buckets section, but that's creating subordinate, subbuckets, like in my example, within failures, maybe showing several severity of failures. But this guidance doesn't seem to work for me.

Splitting doesn't seem to work, since subordinate is implied. I want independent metrics, one per row, in my heat map.

I think I, and the prior poster I referenced, really want multi _metric_ capability in heat map.

I think a work around is for me to create a separate event for each single failure at each station. Even though I have a count already, I need to dumb it down to simple events, one per failure. So for example, at 14:00 in my example, I'd have 8 station1 events, 4 station2 events, and 1 station3 event, and let kibana count them up

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [September 21, 2018, 2:58am UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392/4 "2018-09-21T02:58:56Z")

</div>

Yup I'm thinking you have the right idea. Kibana's classic visualizations will work best with flattened, singular events. Points via multiple metrics would be great, but I suspect it'll be bucketing focused for the near future.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 2:59am UTC](https://discuss.elastic.co/t/multiple-row-metric-heat-hap/148392/5 "2018-10-19T02:59:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
