# Sorting fields for Visualize Pie **URL:** \ **Category:** Kibana\ **Created:** [September 20, 2018, 6:56am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240 "2018-09-20T06:56:54Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 6:56am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/1 "2018-09-20T06:56:54Z")
Hello. I have a field "UserId" in the logs When the user is not authorized his id is 0 I want to create a Visualize Pie where there are two parts: one log with UserId==0, in the other all others Tell me how to do this? Whether to use JSON-input? _kibana 6.3.2_ ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 20, 2018, 8:56am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/2 "2018-09-20T08:56:37Z")
Easy Way : 2 Visualizations First one : Add filter with "Userid is "0"" , Second one : add Filter with "UserId is not "0"" If you want to split the same PIE you can do it like this ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/a/fa322ac507fcab368b374e1d892f1fbb2faca33e.png) ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 9:15am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/3 "2018-09-20T09:15:09Z")
excellent! thank you very much:grinning: I have tried UserId!=0 and it did not work))) ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 9:48am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/4 "2018-09-20T09:48:15Z")
Metrics I expose as unique count on a field with a hash on hadrware PC. that is, I have one pc that counts as authorized and as unauthorized. Is it possible to solve this problem somehow? ![lan](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5b5374898d983530b054077e9002b52b1e58e698.png) thank you ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/5 "2018-09-20T09:56:52Z")
> [@awp-sirius](#): > > Metrics I expose as unique count on a field with a hash on hadrware PC. > that is, I have one pc that counts as authorized and as unauthorized. > Is it possible to solve this problem somehow? I don't really understand what you mean. You already have a filter , so why using unique count ? In your filter you may should write : UserId.keyword:0 instead of UserId:0 ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 10:14am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/6 "2018-09-20T10:14:56Z")
for example ... At me in logs 100 UniqueCode is a computer hash. 40 uniq - not logged in 40 uniq - authorized and 20 uniq has logs where they were not authorized, and then logged in. Now it will show me how 50/50% I want 60/40% That is, filter the unique count fields by metric, then UserId: 0, then from the remainder !UserId: 0 ![%D0%91%D0%B5%D0%B7%D1%8B%D0%BC%D1%8F%D0%BD%D0%BD%D1%8B%D0%B9](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e412f973241f8569a042c4e80e34cb34328e7c90.png) I want that when adding UserId: 0 and !UserId: 0 it turned out 100, not 120 ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 20, 2018, 11:19am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/7 "2018-09-20T11:19:12Z")
There is an inconsistency in your explanation . Or there's something I misunderstood. What are all the possibles values of the `UserId` field ? ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 11:41am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/8 "2018-09-20T11:41:03Z")
0 (if not authorized), 132, 435, 634, 574 - number Type. I can have such logs: ``` { UniqueCode : "FH5435DGFHJ63DXFRH98LOG34CDG12SCA"; UserId : 0 } ``` //-- ``` { UniqueCode : "FH5435DGFHJ63DXFRH98LOG34CDG12SCA"; UserId : 112 } ``` //-- ``` { UniqueCode : "1EF2SDFSD4GER5WRPI3F2FEF5WF4WF1EF2"; UserId : 0 } ``` 3 logs. User _112_ launched the application, went to the log, and after the user was authorized. I want that in this case the pie would be divided 1 to 1, not 1 to 2. ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 20, 2018, 12:58pm UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/9 "2018-09-20T12:58:47Z")
Ok , tell me if i'm right : _the "user" referecend by FH5435DGFHJ63DXFRH98LOG34CDG12SCA lauched the app so his useriD is set to 0,_ _And then got authorized so the userid is set to 112 .._ Am i Right ? ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 1:00pm UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/10 "2018-09-20T13:00:31Z")
yes. And I need to somehow ignore the logs where useriD set to 0 if it is later authorized ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 20, 2018, 2:01pm UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/11 "2018-09-20T14:01:41Z")
Awww, Ok , I got it .. Hummm... It's totally different of what i was thinking You can try to do it by writting weird lucene query In the filter input you can write any lucene expression . ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4cad9a08a83014bdfd64f68d090996d1524025fd.png) which make this query ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4e179d9de5f0b8bba136e8e5aad37569500cfee.png) You can try something in this way .. ---
**Author:** ![awp-sirius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/awp-sirius/32/35686_2.png) [@awp-sirius](https://discuss.elastic.co/u/awp-sirius)\ **Post date:** [September 20, 2018, 5:59pm UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/12 "2018-09-20T17:59:38Z")
Thanks, tomorrow I'll try. and where you can read about what? jesus: kebab and analyze\_wildcard...... what does it mean ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 25, 2018, 6:57am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/13 "2018-09-25T06:57:59Z")
> [@awp-sirius](#): > > and where you can read about what? I did not read about that anywhere , it's something i've found by myself . I don't know where the doc is . > [@awp-sirius](#): > > jesus: kebab and analyze\_wildcard...... jesus:kebab mean you will search the field jesus with value kebab (i wrote this just for example) [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html](http://Wildcard) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 23, 2018, 6:58am UTC](https://discuss.elastic.co/t/sorting-fields-for-visualize-pie/149240/14 "2018-10-23T06:58:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.