Kibana Filtering visualization fields

Question

I am quite new to Kibana, hoping someone can help me get past an issue I'm having.

I have memory profiling from multiple VMs getting put into elasticsearch using a custom beat. When in the Discover, I see all the JSON responses.

eg.

beat.hostname = Node(1...5) -- I have 5 of these nodes, each with their response ... response.body:{"value":{"used":18213048}} (among other fields)

I'd like to visualize this in a line chart; time on the X-axis, and used memory on the Y-axis, but I'd like to have multiple lines (one for each Node/hostname).

I put time on the X-axis, and, while the Y-axis allows me to select the Average aggregation of response.jsonBody.value.used (which is what I want), it seems to be taking all the values regardless of hostname. Is there a way to filter these so that I can have one line in the graph for each hostname? Something like:

Field1

response.jsonBody.value.used AND beat.hostname=Node1

Field2

response.jsonBody.value.used AND beat.hostname=Node2

etc.

Thanks

Answer 1

if line visualization you should use split line in buckets configuration with host name attribute...