Visualizing a workflow

[gbisada]

Hello -
Require advice or guidance on how I can deliver the requirement below.

First, the input:
I have several ascii logs that contain a series of steps that a user performed, each in a single line. For instance, for user 1, the log file on his machine may look like this:
Line #1: USER1 2019/05/20 Launched new tab window
Line #2: USER1 2019/05/20 Created new object
Line #3: USER1 2019/05/20 General viewing

Similarly, user 2 would have different steps he's taken.

Currently, I'm using filebeat to transfer these files. And this is successfully working. Now i have an index that contains each of these columns, and an attribute that says the LineNumber. Index looks like this:
"properties" : {
"userid" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"msgaction" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"eventTime" : {
"type" : "date"
},
"lineNumber" : {
"type" : "long"
}
}
}

Requirement:
I'd like to present a pie/donut chart that would show in each sub-bucket (segment) the different actions. For instance, the inner sub-bucket, would contain all users' first action (line #1 in all users); and then the second sub-bucket would contain all users' second action.
I sense that in order to achieve this, I need to have ability for every sub-bucket to say something like "lineNumber is X", changing that for each sub-bucket.

Any advise how I can achieve this through Kibana, if at all?

Using Elastic, Kibana and Logstash v 6.6.1

Thanks,
George

[thomasneirynck]

@gbisada

I am not sure you will be able to do this with Kibana right now. The challenge is that the sequence of actions are in different documents. You would need to formulate a query where you group the data, first by 1st action, and then be 2nd action into a single response. From the top of my head, not sure how you would formulate that query in Elasticsearch.

[gbisada]

Thanks - I’m unsure either so will continue looking. I must say, it is very disappointing and puzzling that it is not possible to do this neither in visualizations nor graph. i.e. ability to filter in a nested aggregate when visualizing. Thanks, G