# Visualization for delivery comfiramtion

**URL:** https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385
**Category:** Kibana
**Created:** [April 6, 2021, 11:46pm UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385 "2021-04-06T23:46:28Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)
#### Post date: [April 6, 2021, 11:46pm UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/1 "2021-04-06T23:46:28Z")

</div>

Hello everyone, so i have index with 2 types of events:  
1 - Requests  
with field ID: 123  
2 - Response  
with field ID: 123  
"Response" event with same field "ID" and same value. It tells me that some delivery indeed happend in my application.

I was wondering if its possible to create vizualisation that will show ID's with "Request" but without "Response" events. So basicly this ID should have count 1, not 2.

I am using Kibana 7.11

---

<div class="post-metadata">

### Author: ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [April 7, 2021, 12:24am UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/2 "2021-04-07T00:24:11Z")

</div>

I would think of a different solution.  
For example - update the index/document, instead of creating a new doc.  
Then you can get the latest status of each event.  
In addition, you can store parameters like "Request Timestamp", "Response Timestamp", etc. for calculations related to date/time.

Cheers!

---

<div class="post-metadata">

### Author: ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)
#### Post date: [April 7, 2021, 4:03am UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/3 "2021-04-07T04:03:08Z")

</div>

You can create a detection rule using EQL to detect those situations. EQL is able to detect sequences of events.

In your data table visualization you are using terms aggregations for the ID + Requst + Response.  
Also make sure to click on Show partial rows.  
Finally you could create a Dropdown on the dashboard that is using the results of the detection engine so that you can easily filter.

---

<div class="post-metadata">

### Author: ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)
#### Post date: [April 7, 2021, 9:19am UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/4 "2021-04-07T09:19:11Z")

</div>

Updating doc is a nice idea, thank you. As far as i know - i should create custom doc id then, right?

---

<div class="post-metadata">

### Author: ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)
#### Post date: [April 7, 2021, 9:25am UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/5 "2021-04-07T09:25:59Z")

</div>

Thank you, I wil look into that, seems like i dont have "detections" enabled. I will check my access rights.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2021, 9:26am UTC](https://discuss.elastic.co/t/visualization-for-delivery-comfiramtion/269385/6 "2021-05-05T09:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
