Unable to use Top hit for ip address in pie chart

[Sandeep_Raju (Sandy)]

Hi all,

I'm trying to give a pie chart in kibana for ip address to monitor the up/down status of a device.

SO many times, device ip may be down, but currently it is up.

SO i want to give top hit of ip ordered by timestamp, so that it gives latest status of device up.

But in metric of pie chart visualization, top hit doesn't consider ip address.

If i use unique count, it also considers down monitoring.

Any turnaround for this.

Thanks in advance.

[rashmi (kulkarni)]

Hi,
you can achieve this by doing two separate "filters" aggregations - one to split the slices and one to split the charts themselves. If you add a bucket aggregation you can select whether you want to split the chart or the slices.

say for ex: The chart split aggregation should have the filters "monitor.name:xxxx", "monitor.name:yyyy" and "monitor.name:zzzz", the slice split aggregation should have the filters "monitor.status:up" and "monitor.status:down".

If you want to further split the slices for each donut, you can keep adding "Split slices" filters aggregations.

Let me know whether that helps.

cc @flash1293 is this direction right ? may be you want to add more inputs?

[Sandeep_Raju (Sandy)]

@rashmi ma'am,

Thank you for your inputs.

But there are 40 device ip's which have to be displayed in single chart as per needs.

Need is of a single pie chart which shows latest status of devices as device may go up and down several times in day.

Im able to do this in a data table using top hit .

Don't know why elastic does'nt allow top hit for an ip addressin a pie chart.

Below are my charts and we can see difference.