Timeline bar chart in Kibana

[Borivoj_Vlk (Bořivoj Vlk)]

Hi All,

I would like to create a timeline bar chart in Kibana, preferably using canvas. I have records stored in elastic in following format:

"ParamName": "Status",
"serverTime": 1554929754800,
"value": 5,
"valueStr": "Aborted"

"ParamName": "Status",
"serverTime": 1554911420019,
"value": 3,
"valueStr": "In progress"

Those reconds mean, that status of some machine was "Aborted" from the time in "serverTime" field until the value of "serverTime" field in the next record, which represent status "In progress". The graph I'd like to create should look something like this>

I was able to achieve something similar using following Timelion query, but the problem is that this cannot be used in canvas and might produce wrong results when two recods with different values fall into same bucket (becouse of max aggregation function).

.es(index=statusst, timefield=serverTime, metric="max:value", q="ParamName:Status").fit(carry).if(eq,5,.static(0),null).color("red").lines(width=100),
.es(index=statusst, timefield=serverTime, metric="max:value", q="ParamName:Status").fit(carry).if(eq,3,.static(0),null).color("green").lines(width=100)

Closest thing to what I need, that I was able to find is this> https://discuss.elastic.co/t/bar-chart-with-of-different-values-in-canvas-how/146936/2
But that works only for portions of total, and not for time durations and I was not able to modify it..

Thanks for any help

[Joe_Fleming]

but the problem is that this cannot be used in canvas

Why not? Canvas supports Timelion as a data source...

the problem is [this] might produce wrong results when two recods with different values fall into same bucket

Yes, Elasticsearch doesn't really do document comparison, and aggregations are the wrong model here. You can visualize raw documents in canvas, which is closer (you can get colored bars based on status), but wouldn't produce quite what you want (the space between the lines would not be filled in). Something like this:

| essql
query="SELECT serverTime, valueStr, value
FROM statusst
WHERE ParamName = 'Status'
ORDER BY serverTime"
| pointseries x="serverTime" color="valueStr" y="value"
| plot defaultStyle={seriesStyle bars=1 lines=0 points=0} 
  seriesStyle={seriesStyle label="Aborted" color=#f00} 
  seriesStyle={seriesStyle label="In progress" color=#0f0}
| render

That will produce something close to what you can see in the web logs sample workpad:

Except the bars would vary in height based on the number in value.

You could make a custom view function to draw that differently so the space between the lines is filled in too if you like, it's just not something the Canvas includes.