Split bars on visualisation by using custom query

Hello everyone.

I have two folders in my source (using wildcards) and I have created visualisation based on this.

The big picture is that, I'm visualising amount of errors/failed builds from Jenkins log, now I want to be more specific and I want to split bars into specific reasons of failures.

I have a query with visualisation for total count of failed builds and I have query with visualisation for specific errors that makes the build fail.

I want to aggregate them into bars and visualise total amount of builds and amount of specific errors that caused build to fail, with daily timestamp.

Example below

kibana_example

I can't find proper option in 'Split series'. Could someone guide me through that or give some advices where to start or if it's even possible?

Greetings

You're so close, you probably want to scroll down the aggregation list a bit and choose the "terms" aggregation for splitting your bars based on the field that indicates what the cause for the error is.

I have no correct term displayed there.

I'm clicking Add sub-buckets, Split Series, then I can select aggregation but nothing from Terms matches my needs.

Visualisation is based on simple query that counts all log entries and that's all, maybe I missed some particular step?

If you scroll here, you don’t see “Terms” under “Significant Terms”?

I can pick Terms but I have preconfigured terms there.

My visualisation is based on query

source:*CLOUD* AND "Finished: FAILURE"

but when I do

source:*CLOUD* AND "docker prune -f"

I ALSO have listed failed builds but only these failed by docker error, ergo bars are showing lets say 10% of error that are shown in previous query. I don't see a proper field that, so I have no clue how to go further with this, despite that it's super basic problem. :confused:

I’m sorry, I’m not sure I understand, but if you’re trying to define the splits with individual queries that you can use the “Filters” bucket aggregation time

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.