# Vega-lite group count - Kibana 6.6

**URL:** <https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040>\
**Category:** Kibana\
**Created:** [February 12, 2019, 1:05pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040 "2019-02-12T13:05:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [February 12, 2019, 1:05pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/1 "2019-02-12T13:05:01Z")

</div>

Hi,

I'm new to vega and trying to show the group count of sourceaddress when you hover over the graph item. The sourceaddress is a string. I've tried various ways but the below only shows zero.

Any help would be much appreciated

Martin

```
{
  "$schema": "https://vega.github.io/schema/vega-lite/v2.4.json",
  data: {
    url: {
      %context%: true
      %timefield%: @timestamp
      index: "acsc-main-controls-*"
      body: {
        size: 1000
        _source: ["@timestamp", "sourceaddress", "control", "controlcategory", "eventid", "acsctype"]
      }
    }
    format: {property: "hits.hits"}
  }
  "width": 600,
  "height": 400,
  "transform": [
    {
     "summarize": [
        {
        "aggregate": "count",
        "as": "xcount"
        }
      ],
      "groupby": ["_source.sourceaddress"]
    },
    {
    calculate: "toDate(datum._source['@timestamp'])" as: "time"
    }
  ],
  "mark": {
    "type": "circle",
    "opacity": 0.8,
    "stroke": "black",
    "strokeWidth": 0
  },
  "encoding": {
    "x": {
      "field": "time",
      "type": "temporal",
      "axis": {"labelAngle": 0}
    },
    "y": {"field": "_source.control", "type": "nominal", "axis": {"title": ""}},
    "tooltip": [
      {"title": "Control Category", "type": "nominal", "field": "_source.controlcategory"},
           {"title": "Control", "type": "nominal", "field": "_source.control"},
      {"title": "Source Address", "type": "nominal", "field": "_source.sourceaddress"}, {"title": "Count", "type": "quantitative", "field": "xcount"}
    ],  
    "size": {
      "field": "_source.sourceaddress",
      "type": "nominal",
      "legend": {"title": "Source Address", "clipHeight": 30},
      "scale": {"range": [0, 1000]}
    },
    "color": {"field": "_source.control", "type": "nominal", "legend": null
    }
  }
   "selection": {
    "selector015": {
      "type": "interval",
      "bind": "scales",
      "encodings": ["x", "y"],
      "on": "[mousedown, window:mouseup] > window:mousemove!",
      "translate": "[mousedown, window:mouseup] > window:mousemove!",
      "zoom": "wheel!",
      "mark": {"fill": "#333", "fillOpacity": 0.125, "stroke": "white"},
      "resolve": "global"
     }
   },
}
```

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [February 18, 2019, 11:59pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/2 "2019-02-18T23:59:20Z")

</div>

@nyuriks help please?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![nyuriks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nyuriks/32/26171_2.png) [@nyuriks](https://discuss.elastic.co/u/nyuriks)\
**Post date:** [February 19, 2019, 12:14am UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/3 "2019-02-19T00:14:00Z")

</div>

Hi @martb, could you post what you already have with these instructions? It would make it easier to figure out what kind of data you have - [https://gist.github.com/nyurik/736c34970ba3c32f3fe3d45d66719b3e](https://gist.github.com/nyurik/736c34970ba3c32f3fe3d45d66719b3e)  
Thanks!

---

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [February 20, 2019, 10:08am UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/4 "2019-02-20T10:08:01Z")

</div>

Hi,

If I paste the below into a vega editor I'll see the relevant details when I hover over the data i.e no. of records, but you don't see such tooltip info in Kibana. Is this a limitation of the version of vega used by Kibana? I'm trying to show the record count when I hover over the data.

Regards

Martin

```
{
  "$schema": "https://vega.github.io/schema/vega-lite/v2.4.json",
  "data": {
    "values": [
      {
        "@timestamp": "2019-02-13T11:15:01Z",
        "control": "Firewall",
        "controlcategory": "Monitoring",
        "platformtype": "Device",
        "eventid": 489,
        "sourceaddress": "192.168.121.74",
        "outcome": "Rejected",
        "platformaddress": "192.168.10.6",
        "transportprotocol": "TCP",
        "@version": "1",
        "destinationport": "42058",
        "acsctype": " 2-7",
        "sourceport": "47750",
        "eventtype": "Packet filtered",
        "outofhours": "false",
        "destinationaddress": "224.0.0.22"
      },
      {
        "@timestamp": "2019-02-13T10:02:36Z",
        "control": "Firewall",
        "controlcategory": "Monitoring",
        "platformtype": "Device",
        "eventid": 350,
        "sourceaddress": "192.168.121.74",
        "outcome": "Rejected",
        "platformaddress": "192.168.10.8",
        "transportprotocol": "TCP",
        "@version": "1",
        "destinationport": "37487",
        "acsctype": "2-7",
        "sourceport": "64262",
        "eventtype": "Packet filtered",
        "outofhours": "false",
        "destinationaddress": "192.168.10.41"
      },
      {
        "@timestamp": "2019-02-13T10:02:36Z",
        "control": "Firewall",
        "controlcategory": "Monitoring",
        "platformtype": "Device",
        "eventid": 351,
        "sourceaddress": "192.168.121.74",
        "outcome": "Rejected",
        "platformaddress": "192.168.10.7",
        "transportprotocol": "TCP",
        "@version": "1",
        "destinationport": "37487",
        "acsctype": "2-7",
        "sourceport": "64262",
        "eventtype": "Packet filtered",
        "outofhours": "false",
        "destinationaddress": "192.168.10.41"
      }
    ]
  },
  "width": 600,
  "height": 400,
  "mark": {
    "type": "circle",
    "opacity": 0.8,
    "stroke": "black",
    "strokeWidth": 1
  },
  "encoding": {
    "x": {
      "field": "@timestamp",
      "type": "temporal",
      "axis": {
        "labelAngle": 0
      }
    },
    "y": {
      "field": "control",
      "type": "nominal"
    },
    "size": {
      "aggregate": "count", 
      "type": "quantitative",
      
      "scale": {
        "range": [
          0,
          1000
        ]
      }
    },
    "color": {
      "field": "controlcategory",
      "type": "nominal"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![nyuriks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nyuriks/32/26171_2.png) [@nyuriks](https://discuss.elastic.co/u/nyuriks)\
**Post date:** [February 20, 2019, 9:02pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/5 "2019-02-20T21:02:15Z")

</div>

@martb if you open the bottom left panel in the Vega editor (compiled Vega), you will see this line:

```
"tooltip": {
   "signal": "{\"@timestamp\": timeFormat(datum[\"@timestamp\"], '%b %d, %Y'), \"control\": ''+datum[\"control\"], \"Count of Records\": format(datum[\"count_*\"], \"\"), \"controlcategory\": ''+datum[\"controlcategory\"]}"
},

```

In other words, Vega Lite generates a tooltip instruction for Vega. If you follow my gist instructions above, you will be able to see the compiled Vega as generated by Kibana's version of Vega-Lite. Take a look if it has tooltip. If it doesn't, this must have been added to Vega-Lite in a newer version. Kibana 7.x will have an updated version of Vega and Vega-Lite.

---

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [February 21, 2019, 5:04pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/6 "2019-02-21T17:04:04Z")

</div>

Hi.

Thanks for reply. This feature doesn't appear to be in the current release i.e 6.6. I will look to see if there is any difference in the 7.x beta.

thanks

Martin

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2019, 5:04pm UTC](https://discuss.elastic.co/t/vega-lite-group-count-kibana-6-6/168040/7 "2019-03-21T17:04:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.