Pie chart on accumulated data

[MarioRojas (Mario)]

Hi All,
I'm very new to Kibana and I need to create a pie chart based on the sum of the values present in different logs, marginalized from a given term in yet another log...

In Discover the data looks like this:

What I need is to have as slices the sum of the event_counts (in this case slice fn should be 68 ). Furthermore, these values are only present, when result_type is "summary".
I've tried creating the pie based on the filter 'result_type is "summary" ' and adding one bucket per even_count but all I've been able to achieve is three concentric rings each divided in six sectors..

I appreciate any suggestions on how to do this (if it can be done) or if there are ideas on even another visualization that can show the sums of these columns, as percentages of the total amount of events.

[Marta_Bondyra]

Hi Mario, unfortunately the way this data is structured doesn't allow you to slice a pie it in easy way (you slice across one field that has different values).

What you can do though, is to get a datatable or a stacked bar chart where you sum these events as separate metrics. Here's the example with using Lens formula:

the formula for the first event would be:
overall_sum(sum(event1))/(overall_sum(sum(event1))+overall_sum(sum(event2))+overall_sum(sum(event3)))
for the second:
overall_sum(sum(event2))/(overall_sum(sum(event1))+overall_sum(sum(event2))+overall_sum(sum(event3)))
and the third:
overall_sum(sum(event3))/(overall_sum(sum(event1))+overall_sum(sum(event2))+overall_sum(sum(event3)))

The value format allows you to format the data to percentages:

Use the chart switcher to try out different chart options.

[MarioRojas (Mario)]

Hi Marta,

Thanks for the quick answer!
I was able to get a percentage visualization using the vertical bars and the formulas you suggested.

Thanks again for the support!

[MarioRojas (Mario)]

Hi again,

I was happy with the visualization , until it was pointed out to me, that, when applying a filter on another variable , the values go blank .
I have checked and in Discovery, i see that these are sort of mutually exclusive.

so, if they filter by "extended" for example, the values in summary are gone and the formulas dont have anything to show...
Would bucket aggregations work here? (sum of buckets in a metric visualization perhaps?)
I mean, i see that what I need is for example to be able to marginalize per type of object, just haven't managed to combine the two ...