[Visualization][Treemap] Multiple object case

Elastic Stack Kibana
1

Hello,

I have tried creating "TreeMap" visualization in Lens. I couldn't get appropriate Visual. I need help to customizing.

image
[Indexed Document Schema]

image
image972×451 31.3 KB

[TreeMap in Lens]

Attached first imaged tells, category : ":ThmRgc" pair with ":Us", and other ":ThmSec" pair with ":It", but when I tried setting "group by" field in Lens Visualization, "first- category", "second - code" Their result is not correct to me.

One example, ":Us" value must belongs to ":ThmRgc" category only, but "Lens" display ":Us" belongs both all ":ThmRgc" and ":ThmSec".
Onother case ":It" value must belongs to ":ThmSec" category only, but "Lens" visualize ":It": belongs both all ":ThmRgc" and ":ThmSec".

I think that "flatten" would be a problem which invoke this incorrect result.

I want to ":It" only group by ":ThmSec", and ":Us" must group only ":ThmRgc" . How can I generate correct treemap?

2

Hi @kwang_hee_Han I am not sure I understand, but just to confirm, you want to filter out only documents that both contain :Us and :ThmRgc OR :It and (:ThmRgc and :ThmSec)?
Instead of creating nested top values aggregation, maybe you could use filters? Here's the tutorial example:

Your KQL first example would be: fieldname1 : :us AND fieldname2: :ThmRgc

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.