Plotting multiple lines from single query in Kibana

Question

I have a server with multiple running JVM's and I want to monitor (not necessarily in real-time) their heap usage using Kibana. I collect such information in ElasticSearch database via LogStash and I have events that have following form

(Note: quotes from JSON keys removed for simplicity)

{ timestamp : "..1", service : "jvm-UsedHeap-App1", metric : 10}
{ timestamp : "..1", service : "jvm-UsedHeap-App2", metric : 20}
{ timestamp : "..2", service : "jvm-UsedHeap-App1", metric : 11}
{ timestamp : "..2", service : "jvm-UsedHeap-App2", metric : 21}

I want to create a histogram graph that will plot 2 lines (in reality more and JVM number is varying, but maximum is < 10) for each traced JVM. I don't want to create a query for each JVM that might appear, I'd rather get this by some trick that will get all unique services (after filtering to service="jvm-UsedHeap-*") and make individual lines for each of the apps. This functionality goes out-of-the-box in Riemann-dash and I hope Kibana can do it too.

EDIT: What about if I have event that have 2 numeric fields and I want to plot them separately? Eg. with collectd input I have events that look like this:

{"@timestamp":"2014-04-24T05:00:20.813Z","plugin":"vmem","collectd_type":"vmpage_io","type_instance":"swap","in":0,"out":3103}

and want to plot 'in' and 'out' as separate lines.

I think that the only way to achieve that with Kibana is to do a query per different JVM. — Pigueiras
I solved it as @Pigueiras suggested, created multiple queries and plotting metric field from all of them. For the case with 2 numeric fields, I am splitting them into 2 separate events, while passing through LogStash and renaming the numeric fields to metric. — Martin

Asimov4 Asimov4 · Accepted Answer · 2014-06-26T06:45:26

In version 3.0.1, you can use a TopN query to achieve that. From this blog post:

Click the colored dot next to a query to do more than set the query color. The new top-N query finds the most popular terms in a field and uses them to compute new queries.

enter image description here

Plotting multiple lines from single query in Kibana

1 Answers