# Timeseries visualization for plotting no. of matching documents against time

**URL:** https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465
**Category:** Kibana
**Created:** [October 27, 2020, 3:53pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465 "2020-10-27T15:53:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sharmashrayansh](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@sharmashrayansh](https://discuss.elastic.co/u/sharmashrayansh)
#### Post date: [October 27, 2020, 3:53pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465/1 "2020-10-27T15:53:56Z")

</div>

Hello,

We are creating a Dashboard to monitor issues from an external system.  
We are collecting data of "issues" using Logstash from a different application and storing them in ElasticSearch.  
As a crucial requirement, we want to plot No. of Open Issues against a timeline.  
Consider a sample document:

```auto
{
  "_id": "978",
  "issue-id": "issue01",
  "status": "OPEN",
  "creation-date": "25-Oct-2020",
  "last-modified-date": "26-Oct-2020"
}

```

We have creation-date, last-modified-date, and @timestamp as date fields. Time is also stored with date, of course.

Now we want to create a timeseries to visualize number of open issues with time.  
So, for example, if an issue closes, the graph should be updated (decrease). If a new issues opens, the line graph should go up, and so on..

I am trying to do this with Time Series Visual Builder (TSVB), but I am not sure on how to have it mathematically correct. I am trying to do a "Cumulative Sum" on Count Aggregation. I have also applied panel filter to only consider "OPEN" issues.  
But this is not correct.  
Is there a mathematically correct way I can find cumulative sum of open issues and plot it against a timeline?

**Regarding index:**  
A new document is created in the index whenever an issue changes.  
So, in essence, all changes of a particular issue are stored within the index.

For example, if status of the above issue (issue01) changes, a new document would be created with a new \_id (the old document is still persisting in the index).

```auto
{
  "_id": "979",
  "issue-id": "issue01",
  "status": "CLOSED",
  "creation-date": "25-Oct-2020",
  "last-modified-date": "27-Oct-2020"
}

```

Should we think of a different way to index the issues also?

Looking for some guidance here.  
Thanks.

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [October 31, 2020, 1:45pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465/2 "2020-10-31T13:45:08Z")

</div>

> Should we think of a different way to index the issues also?

Yes. You should only have a single document per issue and update the status of the document when closed. Then you could use [lens](https://www.elastic.co/guide/en/kibana/7.9/lens.html) to create a chart with time on the x-axis and counts on the y-axis. You can add a filter to only show documents where status is OPEN.

---

<div class="post-metadata">

### Author: ![sharmashrayansh](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@sharmashrayansh](https://discuss.elastic.co/u/sharmashrayansh)
#### Post date: [November 2, 2020, 11:05am UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465/3 "2020-11-02T11:05:14Z")

</div>

Thanks for the reply @Nathan_Reese.  
If we keep only one document per issue, and update the status of the document when closed, how would time-series work?

We want to have a cumulative status of all open issues with time.  
Not the count of open issues created on a particular day.  
That's why I was trying out with cumulative sum of count.

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [November 2, 2020, 1:06pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465/4 "2020-11-02T13:06:08Z")

</div>

Below is an example time series visualization showing 2 metrics on the y-axis. The second metric uses "cumulative sum" pipeline aggregation to track the cumulative sum of count.

 ![Screen Shot 2020-11-02 at 6.04.08 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6efcaa54b652d1e352255c6b8d777c98d1ee29fd.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2020, 1:06pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465/5 "2020-11-30T13:06:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
