# Visualizing Pre-aggregated Data

**URL:** <https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313>\
**Category:** Kibana\
**Created:** [July 25, 2016, 3:53pm UTC](https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313 "2016-07-25T15:53:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![susrich0810](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@susrich0810](https://discuss.elastic.co/u/susrich0810)\
**Post date:** [July 25, 2016, 3:53pm UTC](https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313/1 "2016-07-25T15:53:02Z")

</div>

We've created a python script to pre-aggregate our data, and then re-index it into ES. We've done that part successfully, and we get re-indexed logs similar to the following:

{  
"message" =\> " ... message from file ... ",  
"@version" =\> "1",  
"@timestamp" =\> "2016-07-25T15:36:17.8612",  
"path" =\> "/path/to/my/file/filename",  
"host" =\> "host-server",  
"country" =\> {  
"country\_code" =\> "US",  
"total\_ip\_count" =\> 252,  
"unique\_ip\_count" =\> 31,  
},  
"company-department-name" =\> "dept1",  
company-region" =\> "SW",  
"system-name" =\> "FINANCE"  
}

In the above log, and all other similar logs, I want to be able to visualize each country, and its corresponding 'total\_ip\_count', or 'unique\_ip\_count' in bar charts, etc. How can this be done?

Please let me know!

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [July 25, 2016, 8:07pm UTC](https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313/2 "2016-07-25T20:07:03Z")

</div>

You'll want to select the metric to measure for your Y-Axis. For example if you want the see the average of your IP counts, you'll set "Aggregation" to "Average" and "Field" to `total_ip_count`.

Then for the X-Axis, you'll set "Aggregation" to "Terms" and select `country.country_code` as the field.

That will bucket the average IP Counts per country code in the bar chart.

---

<div class="post-metadata">

**Author:** ![susrich0810](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@susrich0810](https://discuss.elastic.co/u/susrich0810)\
**Post date:** [July 26, 2016, 1:30pm UTC](https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313/3 "2016-07-26T13:30:30Z")

</div>

Great, thanks Tim!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/visualizing-pre-aggregated-data/56313/4 "2017-07-06T13:43:54Z")

</div>