# Table visualization with array data

**URL:** https://discuss.elastic.co/t/table-visualization-with-array-data/379945
**Category:** Kibana
**Created:** [July 9, 2025, 11:41am UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945 "2025-07-09T11:41:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![richard2025](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@richard2025](https://discuss.elastic.co/u/richard2025)
#### Post date: [July 9, 2025, 11:41am UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945/1 "2025-07-09T11:41:58Z")

</div>

Hi,  
I'm using table visualization in ELK 8.17. The doc format are as following:

```auto
"_source": {
   "service": "service1",
   "detail": [
      {
        "name": "microservice1",
        "duration_time": 0.180120
      },
      {
        "name": "microservice2",
        "duration_time": 0.089255
      },
      {
        "name": "microservice3",
        "duration_time": 0.132267
      },
      ...
    ]
}

```

I want to get a table visulization as following:

| Service Name | Microservice Name | Duration Time |
| --- | --- | --- |
| service1 | microservice3 | 0.082923 |
| service1 | microservice2 | 0.102923 |
| service1 | microservice1 | 0.182923 |
| ... | ... | ... |
| | | |
| | | |

I tried with LENS by aggregation by service, name and duration\_time, the result is not what I want. It's a cartesian product of name and duration\_time. I also tried MV\_ZIP name and duration first, then MV\_EXPAND the zipped result with ESQL. It's not cartesian product now, but the name and duration\_time are not in order. How can I get what I want?

---

<div class="post-metadata">

### Author: ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)
#### Post date: [July 10, 2025, 2:11pm UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945/2 "2025-07-10T14:11:37Z")

</div>

Hi @richard2025 ,

Have you considered using Runtime Fields to create a calculated field that preserves the relationship between the data in the array?

---

<div class="post-metadata">

### Author: ![richard2025](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@richard2025](https://discuss.elastic.co/u/richard2025)
#### Post date: [July 11, 2025, 8:46am UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945/3 "2025-07-11T08:46:23Z")

</div>

Hi @Alex_Salgado-Elastic，

Thanks for your reply. I tried with Runtime Fields as following:

```auto
def details = params._source.detail;
def result = "";
if (details != null && details.length > 0) {
  for (int i = 0; i < details.length; i++) {
    result += details[i].name + ":" + details[i].duration_time + ";";
  }

  if (result.endsWith(";") {
    result = result.substring(0, result.length() - 1);
  }
}
emit(result)

```

The new field contains a string with the correct relationship of name and duration\_time. How to split the new field into rows in visualization？

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [July 12, 2025, 7:08am UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945/4 "2025-07-12T07:08:31Z")

</div>

Hello @richard2025

Could you please try using below ES|QL and see if it meets your requirement :

```auto
FROM kib-dash
| EVAL service_name = service
| EVAL paired = MV_ZIP(detail.name, TO_STRING(detail.duration_time))
| MV_EXPAND paired
| EVAL microservice_name = MV_FIRST(SPLIT(paired, ",")),
       duration_time = TO_DOUBLE(MV_LAST(SPLIT(paired, ",")))
| KEEP service_name, microservice_name, duration_time
| SORT service_name ASC, microservice_name ASC
| LIMIT 1000

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30b85a2dbb13f0129f1500a748a215e74bb7b71b.png)

Thanks!!

---

<div class="post-metadata">

### Author: ![richard2025](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@richard2025](https://discuss.elastic.co/u/richard2025)
#### Post date: [July 12, 2025, 12:19pm UTC](https://discuss.elastic.co/t/table-visualization-with-array-data/379945/5 "2025-07-12T12:19:50Z")

</div>

Hello @Tortoise

Thanks for your reply. This is not what I want as the relationship of name and duration\_time is not preserved. According to the document, The order that multivalued fields are read from underlying storage is not guaranteed.