You can aggregate/configure data and visualize the information in different ways– one widget at a time.
Before creating a new visualization, check the existing ones to see if one is readily available.Create a new version and select the visualization tools to specify the format in which you want to view the data – Area chart, data table, line chart, markdown widget, metric, pie chart, tile map, vertical bar chart. You can also view the existing visualizations currently available (lower half of the screen) and make changes if required.Aggregate data in two areas – metrics and buckets. The aggregation options are different for each visualization tool (i.e., chart type) you select.
- Metrics – Used for slice size (pie chart) or Y axis (line, bar or area charts).
- Bucket – Sorts data by the criteria specified. Number of slices (pie chart) or X axis (line, bar or area charts). Common bucket aggregations include date histogram, range, terms, filters, and significant terms.
To create a new visualization:
- Select and select a type of chart (i.e., pie).
The Select a Search page is displayed.
- Select one of the following options to specify the search criteria to be used :
| If you want to | Then |
|---|
| create visualization from a new search | Select From a new Search. The select an index pattern field is displayed. Select the index pattern from the list. The Visualization page is displayed with an empty (pie) chart. |
|---|
| create visualization from a saved search | Select From a saved Search.A list of existing saved searches are displayed. Select one and edit as required. |
|---|
- In the Field list, select the field for visualizing related data (i.e., application.raw ).
The list includes fields available for the selected index pattern.
- Required: In the Order By list, select the field (metric) on which the visualization is ordered, that is, count.
- In the Order field, specify the order of the count for legend display – ascending or descending (i.e., descending).
- In the Size field, enter the size (maximum number of slices?) (i.e., 5).
- In the Exclude Pattern field, enter any fields/patterns you want to exclude from the current search.
If the field in the pattern is "analyzed field", it is counted as two terms. In this case, you can exclude "field" from the analysis to get an accurate picture.
The search results will exclude this field from the visual.
- Optional: Add a sub-bucket and add a further layer to the visualization by specifying the bucket and related fields as follows:
- Click on the split slices on the left and select Increase Priority Option to the right to see the visualization with the selected split as primary information.
- To flip the chart, select the slice on the left panel.
If the visual is a pie chart with donut option, first slice is the count of services in the application and the second layer is error information for each; by selecting the slice or sub-slice, you can view the services as the outer layer with error information as the inner layer or vice versa.
The visualization is modified to reflect your selections.
