Selecting only top 5 values from split series

[Tomas_Law (Tomás Law)]

Hi,

I'm having trouble finding out how to use split series properly.

From my logs, I gather the fields geoip.country_name and geoip.region_name (using the geoip filter plugin in Logstash).

Now, I wanna display a bar chart with the Count of logs for each Region/City grouped by Country.

I selected the Top 5 Countries and the Top 5 Cities.

So far, I am able to get the following chart:

As you can see, Kibana does select the top 5 cities for each of the top 5 countries as intended. Yet, the X-Axis shows empty blank space for each Country (which corresponds to the top 5 cities from the other countries).

How can I eliminate that empty blank space and show only the top 5 cities for each of the countries?

Even better, can Kibana automatically relate the country to the city? That is, can I display all cities for each country (not only the top 5 cities)?

Thank you

[jbudz (Jon Budzenski)]

That's how the normal chart mode operates unfortunately, it preserves order and spacing. If you go to metric and axes and click on stacked, it'll collapse each series into a single bar. Does that work for you?

It should be possible to get all regions. You'll want to start with a terms aggregation on region with a maximal size, and then split series on country name. This'll likely have the same issue with spacing unless stacked mode is used.

[Tomas_Law (Tomás Law)]

Hi Jon,

I had already tried the stacked mode and it does offer a better representation of what I wanted even though it doesn't allow an immediate comparison between each region (I would have to either mouseover to see the count of each region or measure the length of the bar of each region). Ideally, I want all bars to start at the x-axis so that the longer the bar, the larger the count value.

Regarding your suggestion for getting all the regions, using this method, I can show all the regions but they are not grouped by Country. Instead, the Country is indicated by the color of the bar.

(I didn't use maximal size for region terms so that the chart stays readable)

Thanks for the response.