Visualize data by two fields

[Kohlman]

We have multiple clients. Each client has there own instance of our database. While there may be subtle differences in schema as we continue to make enhancements. For purposes of this question we can assume they are the same.

I would like to see which are the largest tables across all the clients. We use metricbeat to pull out data like size of the DB, size of every table etc. If I create a visualization and aggregate by table name . . . it will show me which table is the largest across the sum of all the database instances. What I want to see is which table is largest by client DB and table name. Luckily the db names are all different.

The two ways I can think to solve this are:

• create a new field in elastic and concatenate the values of the db_name & table_name
• modify the SQL metricbeat uses and add another field where I return the concatenated value of the db_name & table_name. This seems to be preferable given the cost of the dynamic field in elastic.

I'm an SQL person. This concept in SQL is as straight forwards as it gets. However, when I try to create a visualization I can add both the db_name and the table_tame as something I want to see, but they are essentially independent. Is there a 3rd way to solve this that I am missing?

Thanks,
Kohlman

[Stratoula_Kalafateli]

Hey! Can you share with me which version of kibana you are using? Also are you using Lens and you want to add a breakdown with multiple values? A screenshot would help to understand better what you are trying to do. A runtime field that concatenates 2 fields is def an option but in newer versions of kibana you can create a breakdown with multiple values in Lens. For example: