Use specific subsets of data for visualization layers

[greendrake (Eugene)]

There is a nice feature in Kibana (I am using v 8.6.2) which allows to add multiple layers to visualizations:

I have the following kind of data in the index:

{
    utc: "<datetime>",
    source: "foo",
    value: 5
},
{
    utc: "<datetime>",
    source: "bar",
    value: 6
},
{
    utc: "<datetime>",
    source: "foo",
    value: 4
},

That is, some metric value is coming from 2 different sources, indexed by datetime.

What I'd like to do is first visualize median values coming from source "foo" only in the 1st layer, then on the 2nd layer — values coming from source "bar". Finally, the graph will show stacked bars telling me which source contributes how much to the total cumulative value from both sources. (The real sources are solar panel arrays, and the values are the power they generate at the specified datetimes).

How can one achieve that? Which parameters need to be set to filter the data for each layer by the source field?

[stephenb (Stephen Brown)]

Is the data in the same index? or 1 different indices?

If in one Indices / Data View

You should simply be able to
Bar Chart Stacked
average(value)
breakdown by source

In this case my case your value is system.load.1 and the breakdown your source is `host.name