Skip to main content

Visualization Builder

How to build and configure custom visualizations.

Setting Up Your Data​

Control Time Range​

Select your time boundaries before configuring aggregations. Choose from predefined ranges like "Last 15 minutes" or "Last 24 hours", or define custom time periods for your analysis.

Apply Filters​

Narrow your data scope by adding field-based filters. Click the filter controls to create new filters, specify field conditions, and combine multiple filters to refine your dataset. Edit existing filters through the filter modal or remove them individually.

Configure Metrics​

Metrics define what you want to measure in your data. Start by adding at least one metric aggregation:

Add Basic Metrics​

  • Count documents - Click "Add Metric" and select "Count" to count total documents
  • Calculate averages - Choose "Average" and select a numeric field to get mean values
  • Sum values - Select "Sum" with a numeric field to total values
  • Find extremes - Use "Min" or "Max" with numeric fields to find boundaries

Add Advanced Metrics​

  • Count unique values - Choose "Unique Count" to count distinct field values
  • Calculate statistics - Use "Median" or "Standard Deviation" for statistical analysis
  • Get percentiles - Select "Percentiles" and specify ranges (25th, 50th, 75th percentiles)
  • Retrieve top results - Use "Top Hit" to get the highest-ranking document

Manage Your Metrics​

Reorder metrics by dragging them up or down to change how they appear in your visualization. Configure parameters like percentile ranges or top hit criteria. Remove metrics you no longer need by clicking the delete option.

Group Data with Buckets​

Buckets segment your data into meaningful groups. Add bucket aggregations to break down your metrics:

Group by Categories​

  • Group by field values - Choose "Terms" aggregation and select a field to group by most common values
  • Set group size - Configure how many top terms to display (default 10)
  • Order results - Choose ascending or descending order for your groups

Group by Time​

  • Create time intervals - Select "Date Histogram" with a date field
  • Set time intervals - Choose from auto-generated intervals or specify custom ones (1m, 1h, 1d)
  • Handle missing data - Configure how to treat documents with missing date values

Group by Ranges​

  • Create numeric ranges - Use "Histogram" to create equal-sized numeric intervals
  • Define custom ranges - Select "Range" to specify your own value boundaries
  • Group IP addresses - Use "IP Range" for network-based grouping

Manage Bucket Hierarchy​

Drag buckets to reorder them - the order determines your grouping hierarchy. Configure bucket-specific settings like interval sizes, range boundaries, and sorting preferences.

Build Your Visualization​

Start with Metrics​

Begin by configuring what you want to measure. Add Count for basic document counting, or choose specific metrics for numeric analysis.

Add Grouping​

Once you have metrics, add bucket aggregations to segment your data. The first bucket creates your primary grouping, additional buckets create sub-groups.

Apply Time Constraints​

Set your time range to focus on specific periods. This filters all data before aggregations run.

Preview and Adjust​

Watch your chart update in real-time as you modify settings. If you see errors, check that your field selections match the aggregation requirements.

Save Your Work​

Save completed visualizations by clicking the save option. Give your visualization a descriptive name for easy retrieval. Load saved visualizations to continue editing or create variations.

Work with Chart Types​

Different chart types support different aggregation combinations:

Pie Charts​

Use Sum, Count, Unique Count, or Top Hit metrics. Avoid geographic bucket types. Best for showing proportional relationships.

Line and Area Charts​

Work well with Date Histogram buckets for time-series analysis. Add multiple metrics to compare trends over time.

Bar Charts​

Support all aggregation types. Effective for categorical comparisons and ranking data.

Data Tables​

Display any combination of metrics and buckets. Useful for detailed data examination.