Stacked chart with Kibana

[SarojELK (IZSELK)]

Hello again Experts,

my Kibana skills are just starting with visualization.
i have successfully ingested the data to ES and now i need to create a stacked chart as per attached picture,

i needed to plot a stacked chart for 'TimeSpent' with 'Num_Objects' against different function Type, X axis should carry the @timestamp

Any help would be really appreciable, I am struggling from last 1 week to get this created.

BR
ELK Rocks

[Brandon_Kobel]

Hey @SarojELK,

It sounds like you're trying to build a Vertical Bar chart with a Date Histogram aggregations on the X-Axis and the TimeSpent on the Y-Axis.

This can be done with the following configuration in Visualize:

If you'd like to split the TimeSpent based on the function_type, you can add a split series sub-aggregation with a terms aggregation on the "Function_Type" as displayed below:

giving you a graph similar to the following:

This graph is excluding the Num_Objects aspect, as I'm unsure how you'd like that to be reflected in your chart.

[SarojELK (IZSELK)]

Hey @Brandon_Kobel,

I guess, i found my issue in my data, how i have ingested into ES.
my Num_Objects & TimeSpent both got mapped as in type :keyword, which needed to be number or integer.
do you have any suggestion? how can i convert the type from keyword to integer or number for data already indexed ?
even if i need to re-index the data how should point my own mapping? in filebeat or logstash ?

"mappings": {
      "doc": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "@version": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "Function_Type": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "Num_Objects": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "TimeSpent": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256

DO you have any suggestion ?

[Brandon_Kobel]

Hey @SarojELK, I'd suggest starting by creating a new Index and specifying the proper mappings per the docs. You can then point your newly ingested data at the new indices, and then use the Reindex API to copy over the historical data with the proper types.