Three Plots from one Data View With Two Different Split Series Applying Individually

I have three data plots I wish to display in one visualization. All data is from one wildcard data view and I have defined three y-axes. I would like to have two stacked data plots (line charts, in this case), split by one Bucket/Split Series, and the remaining plot made over the other split series. This works great for two plots with one split series, but when I add a third plot and try to apply a second split series, there is no way to apply said series to the third plot only, it applies to all and is not what I'm looking for as it destroys the first two plots.

Is this even possible? Can I have three plots from one view in one visualization? I'm ultimately trying to show three buckets:
Demand by Group 1
Usage by Group 1
Total Available Resources by Group 2
All three have same units for the y-axes.

The data has one shared timestamp and aligns properly on the horizontal axis but there seems to be no way to get the 'splitting by different Groups' to work.

If there is documentation on this, feel free to point me to it. But my searching has yielded no results so far. But maybe my search terms are wrong.


Hi @nickbarry Welcome to the community

What version are you on...
Although I am not quite sure I am following but I think you should be able to do this with Lens.
Lens allows you to put N (in your case 3) different/distinct plots on the same visualization...

Well, I can get all three plots on the same viz but I can't make them divide by the proper bucket. For two of the data sets/plots, I want to apply one split series. For the other plot I want to apply a different split series. If I show/apply both of the split series, however, /all/ plots have both split series applied. I've got all three plots each on their own axes as well, to keep the data plots from stacking on each other (i.e., their origins are all at 0 on the y-axis, which is what I want). But it seems I can't apply separate split series to just individual plot data sets. Either the split series applies to all or none. And I believe we're on v7. I can confirm this in a bit.

Yes, that's why I asked the version...
And knowing the exact version would help as there's been a lot of new features over the previous releases.

In the newer versions of lens, you can create three (or more) entirely separate visualizations on a single graph.

What visualization are you using? Can you show a screenshot? Is it TSVB or just the legacy based aggregation which I suspect that's what you're using. And no, I don't think you'll be able to do what you want if that's what you're using.

Well, turns out, if I'm reading it correctly, we're using Kibana v8.1.1. So the indication seems to be that I would have to use TSVB to get the plots I want all on one graph. I can give that a shot after reading the docs.

I've attached a very stripped out shot of how I'm currently attempting to do this. A couple of the buckets are disabled b/c that's where I run into the troubles, if I turn them back on.

I can't show the data b/c it's... very much proprietary.

Yes Mostly Likely TSVB (3 Separate Series) or You can try Lens ... I am not sure when the MultiPlot came to Lens

I think the problem I'm having with Lens is that the third plot has to share an axis with one of the other plots. Which results in the third plot values stacking on top of it's axis-mate. I'm breaking down by two different keyword fields to show summed values in the plot, grouped by keyword. And if an axis has to be shared, the third plot doesn't start its counts at origin, it starts counting/stacking above the other plot. Unless I'm missing something. This is why I trying 'Aggregation-Based > Vertical Bar (and having little luck there, either).

I'll keep forging ahead with TSVB to see if I can hammer out what I need.

So, TSVB is getting me there... almost. But now I get the dreaded:

"Your query attempted to fetch too much data. Reducing the time range or changing the interval used usually fixes the issue."

Mostly when I try to show data on a per-month (rather than per day or per week) basis. Upping the "TSVB buckets limit" doesn't help. The problem is that there are some fields that are calculated on a per-month basis in our SQL database and if I can't display on a per-month basis, the visualizations are not correct.

3 Separate Vertical Axis Ranges on Lens, yup that does not appear to be supported even in new versions... Looks like you can do 3 in TSVB

What is this set to in TSVB


And that's the setting that gives me the error.

'1w' gets the data to show, but that doesn't work as the requirement is for monthly buckets. I'm currently looking into Rollup Data to cut out the fields I don't need to hopefully make it work.

try auto... or the super cool >= 1m :slight_smile:

Yes if you set 1m yup it will break / run really slow as you increase the timerange

Oh just saw you want Monthly... you mean Monthly or 30 Days ...

Yes that may make things a bit more difficult

Rollup could work...

But just to be clear ... the "too much data" error is normally more about the number of time buckets not the data in each document ...

Rollup may help with that because it reduces the number documents in a time bucket ... cutting in / out fields withing documents may / may not.

'auto' and '>=1m' both give me visualization blocks on a weekly basis.

Oh just saw you want Monthly... you mean Monthly or 30 Days ...

Yeah, the monthly is a management request for this dashboard. So weekly won't work. And there are values coming into the index that are calculated in a pipeline done on a monthly basis. I get that we have a metric shedload of data so it's a challenge to hammer it all into place.

1 Like

It might be a situation where I have to aggregate the data upstream, coming out of SQL, say, rather than having the ELK stack do it.

Lens has more features about Monthly etc... but no 3 axes on same graph...

So 3 little side-by-side graphs does not work :wink: (Yes I have worked with many particular customers / Execs)

did you try 1M as the interval that is 1 month

Lolwut? You are the wind beneath my wings. It did work. But what does it do vs. '1m'? The data looks sane.

1m = 1 minute >= 1m means bucket is gte 1 min
1M = 1 Month
The interval drives TSVB date histogram buckets

Wow! Light dawns on Marblehead. Thank you! That is exactly what I was looking for.

1 Like

Yeah there often some magic incantation :slight_smile:

No kidding! That's brilliant. Does this notation apply to other areas of Kibana (for future reference)?