# Nested aggregation charts

**URL:** <https://discuss.elastic.co/t/nested-aggregation-charts/41523>\
**Category:** Kibana\
**Created:** [February 11, 2016, 4:55pm UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523 "2016-02-11T16:55:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tibor\_Schmidt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tibor_schmidt/32/24892_2.png) [@Tibor\_Schmidt](https://discuss.elastic.co/u/Tibor_Schmidt)\
**Post date:** [February 11, 2016, 4:55pm UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/1 "2016-02-11T16:55:07Z")

</div>

Having this example mapping  
`{ "mappings": { "scanner": { "properties": { "profiler": { "include_in_parent": true, "properties": { "module": { "analyzer": "not_analyzed_lower1024", "type": "string" }, "cputime": { "type": "long" } }, "type": "nested" } } } } }`

is there currently a way (even a hacky way) to reproduce nested highlight from K3 for profiler.module as a key field and mean of profiler.cputime as a value field?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/4/42573ace80d4e21d463ed3bbd572e5ca106245b1.png)

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [February 11, 2016, 6:24pm UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/2 "2016-02-11T18:24:52Z")

</div>

Echoing the IRC response here for consistency:

> @rashidkpc: yeah, currently no way todo that

---

<div class="post-metadata">

**Author:** ![tswider](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@tswider](https://discuss.elastic.co/u/tswider)\
**Post date:** [February 17, 2016, 8:26am UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/3 "2016-02-17T08:26:37Z")

</div>

So yes it is hacky but you can do it as follws in that fork of k3 [https://github.com/immunochomik/kibana3](https://github.com/immunochomik/kibana3) you open profiler.module in terms tab, then on the bottom of the tab there is a button 'Make Queries' - when you press that it will make queries for all the therms that is single query for each value of profiler.module (assuming the cardinality is reasonable let say up to 12 as on your example) , and then on the time histogram you can set value field to profiler.cputime and vuala.  
There is a bug there that I am planing to fix, if the terms are made of more than one word it should put "" around them in queries and it does not do that, very simple fix there.

---

<div class="post-metadata">

**Author:** ![tswider](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@tswider](https://discuss.elastic.co/u/tswider)\
**Post date:** [February 17, 2016, 8:42am UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/4 "2016-02-17T08:42:46Z")

</div>

So there are things that you can not do and there is no point in my opinion in adding them to k3 for example there are no value based histograms, but you have them in k4 so no point in reimplementing that, I think k3 is useful for events discovery, assessment of volumes of events in time based data, where k4 even k4.4 just does not do that well

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [March 8, 2016, 3:50am UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/5 "2016-03-08T03:50:12Z")

</div>

Tibor\_Schmidt are you using out-of-the-box or forked version of K3 to produce that chart? If it's a fork, could you link to it? Also could you post a screenshot of your panel config?

---

<div class="post-metadata">

**Author:** ![Tibor\_Schmidt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tibor_schmidt/32/24892_2.png) [@Tibor\_Schmidt](https://discuss.elastic.co/u/Tibor_Schmidt)\
**Post date:** [March 8, 2016, 8:19am UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/6 "2016-03-08T08:19:17Z")

</div>

@tbragin It's private fork, main dev is mostly c++/python/(java) guy and the changes are "hacked in" just to make work what we needed.

Do you think it would be worth to share? I could try to persuade him. 🙂

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d919c61ed5eb283190e0ce7e56497ce70acd5322.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:59pm UTC](https://discuss.elastic.co/t/nested-aggregation-charts/41523/7 "2017-07-06T13:59:53Z")

</div>

Closed on July 6, 2017, 1:59pm UTC


