# Obtaining \`now\` on a kibana visualization

**URL:** https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511
**Category:** Kibana
**Created:** [November 19, 2019, 1:33pm UTC](https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511 "2019-11-19T13:33:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jmartori](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jmartori/32/36981_2.png) [@jmartori](https://discuss.elastic.co/u/jmartori)
#### Post date: [November 19, 2019, 1:33pm UTC](https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511/1 "2019-11-19T13:33:31Z")

</div>

We have our messages with a field timestamp, and I'd like to have a plot to view the difference from `now` to the max(timestamp). This way we can know if we are ingesting properly and how long has it been seen we did.

We are currently using elk 5.6.9, but we are planning on migrating soon to newer versions.

Thanks for the help,

---

<div class="post-metadata">

### Author: ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [November 19, 2019, 2:17pm UTC](https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511/2 "2019-11-19T14:17:53Z")

</div>

I couldn't think of a way to do this with existing Kibana visualizations because you can't add client side calculations there, but fortunately there is the [Vega visualization](https://www.elastic.co/guide/en/kibana/current/vega-graph.html) which allows a lot of flexibility.

The following spec queries elasticsearch with a max aggregation on the `@timestamp` field and then does the calculation against the current time client side using a vega expression (of course you have to substitute your index pattern name and possibly time field name):

```auto
{
  "$schema": "https://vega.github.io/schema/vega/v4.json",
  "data": {
    "name": "es",
    "url": {
     "%context%": true,
      "index": "YOUR_INDEX_NAME",
      "body": {"aggs": {"max_ts": {"max": {"field": "@timestamp"}}}, "size": 0}
    },
    "format": {"property": "aggregations.max_ts.value"}
  },
  "marks": [
    {
      "type": "text",
      "encode": {
        "enter": {
          "fill": {"value": "#000"},
          "text": {"signal": "(now() - data('es')[0].data) / 1000"},
          "fontSize": {"value": 25}
        },
        "update": {"x": {"signal": "10"}, "y": {"signal": "10"}}
      }
    },
    {
      "type": "text",
      "encode": {
        "enter": {
          "fill": {"value": "#000"},
          "text": {"signal": "'Seconds since the last document'"},
          "fontSize": {"value": 25}
        },
        "update": {"x": {"signal": "10"}, "y": {"signal": "40"}}
      }
    }
  ]
}

```

The results looks like this:

 ![23](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf076126901f19c817fd9411441cb6170bc23a6a.png)

---

<div class="post-metadata">

### Author: ![jmartori](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jmartori/32/36981_2.png) [@jmartori](https://discuss.elastic.co/u/jmartori)
#### Post date: [November 19, 2019, 7:04pm UTC](https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511/3 "2019-11-19T19:04:54Z")

</div>

I'll look into that, thanks for the answer.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2019, 7:14pm UTC](https://discuss.elastic.co/t/obtaining-now-on-a-kibana-visualization/208511/4 "2019-12-17T19:14:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.