# Windows log visualization for a number of events per day

**URL:** <https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044>\
**Category:** Kibana\
**Created:** [November 8, 2019, 5:01am UTC](https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044 "2019-11-08T05:01:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![forestgump](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@forestgump](https://discuss.elastic.co/u/forestgump)\
**Post date:** [November 8, 2019, 5:01am UTC](https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044/1 "2019-11-08T05:01:22Z")

</div>

Hi,  
I am new to Kibana and I am trying to visualize on how many times a particular windows event happened per day.  
For an example lets say I want to count the number of successful logons for a server per day. The relevant Windows event ID is 4624. I am successfully getting the windows security log via Winlogbeat to my elasticsearch engine but couldnt figure out the proper settings for a graph.

A vertical bar or a Line graph is preferred.  
Y -axis should be the count of number of events with ID 4624 and X -axis should be the day.

Any help is highly appreciated.  
Thank you.

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [November 9, 2019, 10:17pm UTC](https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044/2 "2019-11-09T22:17:04Z")

</div>

Hi @forestgump,

you can do this by chossing the line visualization when navigating to "Visualize" and clicking the "Add new visualization" there.

To have a per-day date histogram on the x axis you have add a bucket aggregation, select date histogram as the aggregation type and select your time field. In the interval field you can specify the interval (in this case `Daily`).

To only take the logon events into account you have to apply a filter in the top bar - click "Add filter" there and set it to "`your event id field name` is 4624".

 ![41](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6acba7507660a235e4d76a033f0f0afaaad9a801.png)

The filter will be saved along with the visualization.

---

<div class="post-metadata">

**Author:** ![forestgump](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@forestgump](https://discuss.elastic.co/u/forestgump)\
**Post date:** [November 11, 2019, 2:56am UTC](https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044/3 "2019-11-11T02:56:30Z")

</div>

Thanks it worked!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2019, 2:56am UTC](https://discuss.elastic.co/t/windows-log-visualization-for-a-number-of-events-per-day/207044/4 "2019-12-09T02:56:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.