# Vega Visualisation Trend indicator

**URL:** https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600
**Category:** Kibana
**Tags:** vega
**Created:** [April 29, 2021, 8:26am UTC](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600 "2021-04-29T08:26:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![yorick\_c](https://avatars.discourse-cdn.com/v4/letter/y/76d3ee/32.png) [@yorick\_c](https://discuss.elastic.co/u/yorick_c)
#### Post date: [April 29, 2021, 8:26am UTC](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600/1 "2021-04-29T08:26:41Z")

</div>

Hi,

I'm very new to the Vega visualization option within Kibana and I was wondering if someone could help me out. I'm working on an indicator with trends to visualize the difference in the amount of logs of Last Hour and the amount of logs the hour before that.

My question actually is if It is possible to use 2 queries with time ranges in Vega, for so far I did not find any good solution to my question. If any of you knew an answer to this problem I would gladly appreciate your help, it can be 2 queries in Vega or a correction in my request to get what i want.

My Elasticsearch query:

```auto
    GET /_search
    {
      "aggs": {
        "time_buckets": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "1h"
          }
        }
      },
      "query": {
        "range": {
          "@timestamp": {
            "gte": "now-2h/h",
            "lte": "now/h"
          }
        }
      },
      "size": 0
    }

```

This returns this:

```auto
{
  "took" : 22,
  "timed_out" : false,
  "_shards" : {
    "total" : 49,
    "successful" : 49,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 368,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : []
  },
  "aggregations" : {
    "time_buckets" : {
      "buckets" : [
        {
          "key_as_string" : "2021-04-29T06:00:00.000Z",
          "key" : 1619676000000,
          "doc_count" : 152
        },
        {
          "key_as_string" : "2021-04-29T07:00:00.000Z",
          "key" : 1619679600000,
          "doc_count" : 158
        },
        {
          "key_as_string" : "2021-04-29T08:00:00.000Z",
          "key" : 1619683200000,
          "doc_count" : 58
        }
      ]
    }
  }
}

```

But this gives me 3 groups of data, but my visualization only needs 2 and if I would take the sum of those, It is not a valid visualization of the data.

Kind regards  
Yorick

---

<div class="post-metadata">

### Author: ![brianseeders](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brianseeders/32/84831_2.png) [@brianseeders](https://discuss.elastic.co/u/brianseeders)
#### Post date: [May 13, 2021, 5:09pm UTC](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600/2 "2021-05-13T17:09:42Z")

</div>

Hey @yorick_c,

If you use a [date range aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-daterange-aggregation.html) instead, does this get you the data you need? It should return two buckets instead of three.

Example:

```auto
GET _search
{
  "aggs": {
    "range": {
      "date_range": {
        "field": "@timestamp",
        
        "ranges": [
          { "from": "now-2h/h", "to": "now-1h/h" },  
          { "from": "now-1h/h" } 
        ]
      }
    }
  },
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-2h/h",
        "lte": "now/h"
      }
    }
  },
  "size": 0
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2021, 5:09pm UTC](https://discuss.elastic.co/t/vega-visualisation-trend-indicator/271600/3 "2021-06-10T17:09:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
