# Visualizing a workflow

**URL:** <https://discuss.elastic.co/t/visualizing-a-workflow/175234>\
**Category:** Kibana\
**Created:** [April 3, 2019, 3:10pm UTC](https://discuss.elastic.co/t/visualizing-a-workflow/175234 "2019-04-03T15:10:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbisada](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gbisada](https://discuss.elastic.co/u/gbisada)\
**Post date:** [April 3, 2019, 3:10pm UTC](https://discuss.elastic.co/t/visualizing-a-workflow/175234/1 "2019-04-03T15:10:18Z")

</div>

Hello -  
Require advice or guidance on how I can deliver the requirement below.

**First, the input** :  
I have several ascii logs that contain a series of steps that a user performed, each in a single line. For instance, for user 1, the log file on his machine may look like this:  
Line #1: USER1 2019/05/20 Launched new tab window  
Line #2: USER1 2019/05/20 Created new object  
Line #3: USER1 2019/05/20 General viewing

Similarly, user 2 would have different steps he's taken.

Currently, I'm using filebeat to transfer these files. And this is successfully working. Now i have an index that contains each of these columns, and an attribute that says the LineNumber. Index looks like this:  
"properties" : {  
"userid" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"msgaction" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"eventTime" : {  
"type" : "date"  
},  
"lineNumber" : {  
"type" : "long"  
}  
}  
}

**Requirement** :  
I'd like to present a pie/donut chart that would show in each sub-bucket (segment) the different actions. For instance, the inner sub-bucket, would contain all users' first action (line #1 in all users); and then the second sub-bucket would contain all users' second action.  
I sense that in order to achieve this, I need to have ability for every sub-bucket to say something like "lineNumber is X", changing that for each sub-bucket.

Any advise how I can achieve this through Kibana, if at all?

Using Elastic, Kibana and Logstash v 6.6.1

Thanks,  
George

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [April 4, 2019, 5:46pm UTC](https://discuss.elastic.co/t/visualizing-a-workflow/175234/2 "2019-04-04T17:46:58Z")

</div>

@gbisada

I am not sure you will be able to do this with Kibana right now. The challenge is that the sequence of actions are in different documents. You would need to formulate a query where you group the data, first by 1st action, and then be 2nd action into a single response. From the top of my head, not sure how you would formulate that query in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![gbisada](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gbisada](https://discuss.elastic.co/u/gbisada)\
**Post date:** [April 10, 2019, 6:16am UTC](https://discuss.elastic.co/t/visualizing-a-workflow/175234/3 "2019-04-10T06:16:31Z")

</div>

Thanks - I’m unsure either so will continue looking. I must say, it is very disappointing and puzzling that it is not possible to do this neither in visualizations nor graph. i.e. ability to filter in a nested aggregate when visualizing. Thanks, G

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 6:16am UTC](https://discuss.elastic.co/t/visualizing-a-workflow/175234/4 "2019-05-08T06:16:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.