# Visualizing with multiple fields

**URL:** <https://discuss.elastic.co/t/visualizing-with-multiple-fields/183191>\
**Category:** Kibana\
**Created:** [May 28, 2019, 8:40pm UTC](https://discuss.elastic.co/t/visualizing-with-multiple-fields/183191 "2019-05-28T20:40:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![madhan\_dc](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@madhan\_dc](https://discuss.elastic.co/u/madhan_dc)\
**Post date:** [May 28, 2019, 8:40pm UTC](https://discuss.elastic.co/t/visualizing-with-multiple-fields/183191/1 "2019-05-28T20:40:52Z")

</div>

New to ELK, got things up and running. Here is my set up.

Our MQ monitoring tool writes data to Oracle database every 10 minutes with a cumulative statistics information.

I have set up log stash to pull data from oracle and put it in elastic search. I have looked at different forums and product guide but i am finding it rather hard to figure out how to set up vizsualization.

this is example of oracle table columns

queuename  
interval\_start  
interval\_end  
queue\_max\_depth  
queue\_min\_depth  
no\_of\_puts  
no\_of\_gets  
queue\_manager

I am trying to visualize like this

on x axis i want a timeline maybe hourly between two dates and grouped by queue names and on Y axis i want total no of puts for that hour...monitoring tool writes to database every 10 minutes so i am OK with every 10 mini graph as well. How can i accomplish this?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [May 29, 2019, 2:30pm UTC](https://discuss.elastic.co/t/visualizing-with-multiple-fields/183191/2 "2019-05-29T14:30:48Z")

</div>

Is it safe to assume that `interval_start` is a datetime representing the "start" of the time period which `no_of_puts` and the other information is relevant for, where-as `interval_end` is the datetime representing the end of the time period? If so, we'll have to pick one of these to use when creating the visualization to use with the date histogram aggregation. Since we're talking about 10 minute intervals, there's the possibility that one of the documents in ES spans multiple date histogram buckets, so the visualization is potentially slightly skewed. The only way around this is to reduce the time-span which these documents cover, to get more accurate results. The following example uses the `interval_start` as the basis for the date histogram aggregation:

 ![31%20AM](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2bbfd30e14ecc5f21369238b6ba18963ee4f477.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 2:30pm UTC](https://discuss.elastic.co/t/visualizing-with-multiple-fields/183191/3 "2019-06-26T14:30:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.