Analytics Vidhya
Published in

Analytics Vidhya

Create a Pie Chart in Kibana

In this blog, I am going to explain how you can create a pie chart in Kibana to show Apache2 log data captured through Filebeat. So basically I will plot the pie chart to show multiple field values like response code, HTTP method and total bytes sent.

We will create a simple pie chart that will show multidimensional data where it will create buckets for each of the fields. Following Filebeat data structure we are going to use for creating Pie chart:

"_index": "filebeat-6.5.2-2018.12.13",
"_type": "doc",
"_id": "-Z9Ap2cBI_XuAVP8QgYj",
"_version": 1,
"_score": null,
"_source": {
"offset": 2508,
"apache2": {
"access": {
"referrer": "http://localhost/test/admin.php?username=root&db=mysite",
"response_code": "200",
"remote_ip": "",
"method": "GET",
"user_name": "-",
"http_version": "1.1",
"body_sent": {
"bytes": "4180"
"url": "/test/admin.php?username=root&db=mysite&script=db",
"user_agent": {
"original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0",
"major": "63",
"minor": "0",
"os": "Ubuntu",
"name": "Firefox",
"os_name": "Ubuntu",
"device": "Other"
"prospector": {
"type": "log"
"read_timestamp": "2018-12-13T10:56:32.756Z",
"source": "/var/log/apache2/access.log",
"fileset": {
"module": "apache2",
"name": "access"
"input": {
"type": "log"
"@timestamp": "2018-12-13T08:03:29.000Z",
"beat": {
"hostname": "DLILPTP0305",
"name": "DLILPTP0305",
"version": "6.5.2"
"host": {
"name": "DLILPTP0305"
"fields": {
"@timestamp": [
"highlight": {
"apache2.access.method": [
"sort": [

The above document of the filebeat index is showing the metrics of Apache log data. So I will use the fields from this document in order to create the pie chart. We need to do the following for creating the chart:

  • Click on Visualize link from the left menu. This will open the save visualization link.
  • Click on the plus icon the create a new visualization.
  • From Select visualization type screen, click on the pie chart box. This will open a screen to select the index or saved search object.
  • Click on Filebeat if you have a Filebeat index or choose your own index pattern.
  • Select count under the “Metrics” option.
  • Under Buckets option, select terms for aggregation and select the response_code field of Apache under field option.
  • Add the custom label as per the field name.
  • Now click on the “Add sub-buckets” button to add more fields to aggregate.
  • Add HTTP method and total bytes sent field for aggregation.
  • After adding all these fields click on the “Apply Changes” button icon on the configuration panel.

This will load the visualization as shown in the below screen-shot.

We can click on any section of the visualization to drill-down into the chart and in this way we can get the desired set of data using the visualization. For example, if we want to see only POST requests with response code 302, we can directly click on these sections to filter out the chart.

If you found this article interesting, then you can explore “Mastering Kibana 6.0”, “Kibana 7 Quick Start Guide”, “Learning Kibana 7”, and “Elasticsearch 7 Quick Start Guide” books to get more insight about Elastic Stack, how to perform data analysis, and how you can create dashboards for key performance indicators using Kibana.

If you have any query then please leave a comment. If you like this blog then please clap and share. You can also follow me on Twitter:

BookAuthority 6 Best Elastic Stack Books of All Time
1- Mastering Kibana 6.0 (Anurag Srivastava)
3- Kibana 7 Quick Start Guide (Anurag Srivastava)
5- Learning Kibana 7 (Anurag Srivastava, Bahaaldine Azarmi)
6- Elasticsearch 7 Quick Start Guide (Anurag Srivastava, Douglas Miller)

Originally published at



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Anurag Srivastava

Anurag Srivastava

Author of “Mastering Kibana6.x”, “Kibana7 Quick Start Guide”, “Learning Kibana7”, &“Elasticsearch7 Quick Start Guide” books & AWS Certified Solutions Architect.