# Select columns in a Date Histogram visualization chart

**URL:** https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149
**Category:** Kibana
**Created:** [March 13, 2021, 11:44am UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149 "2021-03-13T11:44:54Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 13, 2021, 11:44am UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/1 "2021-03-13T11:44:54Z")

</div>

I want to select some columns of the following date histogram based on date range  
e.g 18:00 daily  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14e873108c6d802518502a852565fd0517d41d0e.png)

Added: The columns represent the sum of documents per 6 hour interval

See required result below  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68cd1d5a41ea76861942d3ddf5b2fb3af6663e00.png)  
Thanks, Arieh Tal

---

<div class="post-metadata">

### Author: ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [March 15, 2021, 10:04am UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/2 "2021-03-15T10:04:04Z")

</div>

The easiest way to do this is to have a separate field in your index "hour\_of\_day" - then you can place a filter on this field in your visualization and the chart will show up as you expect.

The logs sample dataset has a scripted field for this purpose.

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 15, 2021, 3:42pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/3 "2021-03-15T15:42:17Z")

</div>

Dear Joe,

Sorry for the late reaction.

Where do I find the The logs sample dataset?

Of course I tried this method already by using a hour of day field but unfortunately the number of documents is wrong in the result compared to the 6 hour buckets [see below-counts are in millions]  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c983e52709806bb14d66dab61e3e300172b2cdd7.png)  
I tried using the following filters:

Buckets

X-axis @timestamp per 6 hours

Split chart

Split chart by rows

Sub aggregation

Filters

Filter 1 “uur” is hour of day in dutch

uur: 0 [selected column is 18:00]  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aa6e1fe071c0e51a809cdc3846c964b9a1d0480.png)

Counts are too low: on 22-09 should be 8.136.164  
Second try: uur\>=18

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e42cfd9ef3e6739f35ee6089ebbdb7a27c02b383.png)

The counts are Ok now for the 22-09 but not for the rest!

I tried also using two conditions like uur \>=18 and uur \<=0 but no results.

I also saved the counts in an excel sheet if you want to have a look at them.

Thanks a lot, Arieh Tal

---

<div class="post-metadata">

### Author: ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [March 15, 2021, 3:45pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/4 "2021-03-15T15:45:38Z")

</div>

It depends on the Kibana version where exactly, but if you to to the Kibana "home" app (clicking the logo), there should be a link somewhere (search for "sample").

A common problem is time zones - the hour of day is different depending which time zone you use which can lead to confusing results, especially if a different time zone is used for the date buckets.

Can you share your script? How do you calculate `uur`?

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 15, 2021, 4:12pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/5 "2021-03-15T16:12:32Z")

</div>

uur is just a field in my indexes.

Thanks for the tip!!  
uur is wrongly calculated! should be 23 not 1

timestamp:2020-09-28T23:29:59.987080Z @timestamp:Sep 28, 2020 @ 23:29:59.987 year:2,020 month:9 day:29 uur:1 minuut:29 seconde:59 microseconde:987,080 weekday:Tuesday

How should I use timestamp for this selection!  
Best Arieh Tal

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 15, 2021, 4:14pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/6 "2021-03-15T16:14:57Z")

</div>

I can see now that there is one hour time difference between uur calculated and time stamp!

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/7 "2021-03-15T16:31:26Z")

</div>

After adding one hour to the filtering it still doesn't give the right graphics?!  
Is the problem using sum of counts?  
How can I use timestamp filter selection using relative dates/times? as it's exepecting at least one absolute time in the range?  
Thanks again Arieh

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 15, 2021, 5:41pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/8 "2021-03-15T17:41:11Z")

</div>

I'm not using a script but directly via visualize

---

<div class="post-metadata">

### Author: ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [March 16, 2021, 8:49am UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/9 "2021-03-16T08:49:35Z")

</div>

This wouldn't do the trick, right? it's still wrapping at the wrong place and the actual hour 23 is saved as 0. I would recommend fixing this logic upstream, but to test you should be able to create a scripted field which takes the `uur` field, adds 23, then does modulo 24 (which is effectively subtracting 1)

> How can I use timestamp filter selection using relative dates/times? as it's exepecting at least one absolute time in the range?

The timerange filter can work with relative dates just fine

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 16, 2021, 11:04am UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/10 "2021-03-16T11:04:26Z")

</div>

Thanks a lot Joe, I'll try both recommendations.  
Best Arieh

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 17, 2021, 1:14pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/11 "2021-03-17T13:14:02Z")

</div>

Dear Joe  
I tried both solutions but unfortunately it doesn't seem to work?!

1. using script field  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0dc2df3c0f3f349d25a06fc1813deb90f095c4d.png)  
It takes for ever! is my script correct?

2. Using date range on timestamp  
using one range gives the right result, see figure, but it's not general enough as I have to use the absolute date while using only the time of day will imply all dates which is what I want.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4679c457706e2cfb870b821c5f94335b01ae0a4.png)

Anyway when I add another range only the last one is presented?!  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a147933613167170a8ca83e7dccffdea613f1de.png)

My problem is that I want to select per time interval of 6 hours for any time window, which should work using filters.  
e.g. using interval 06-12 hours for sept 26 to sept 29 so that I can follow the log data only for this time interval.

Best , Arieh

---

<div class="post-metadata">

### Author: ![Arieh\_Tal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arieh_tal/32/77531_2.png) [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)
#### Post date: [March 27, 2021, 1:05pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/12 "2021-03-27T13:05:53Z")

</div>

Dear Joe,  
Thanks for your help wrt time zone ! Now I can select time ranges using "uur" [Time of day]  
see log count of 4 time ranges per day

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02bf4bf6f651c590bbc393b64fa13322d3a3ede7.jpeg)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 24, 2021, 1:06pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149/13 "2021-04-24T13:06:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
