How to split bars in graylog?

[ufth]

I have a field from webserver which contains HTTP response code for every request logged, e.g. 200, 404, 301, etc.

How can I split bar chart by HTTP code like I am able to do in Kibana?

I don’t want to see many bars of different size for interval, but I want to see only one bar that is divided into sections of different colors accordingly, so the length of this bar is the amount of the overall requests logged for interval.

As there are many codes and my be custom codes I don’t want to define each of them manually anywhere.

I was only able to get this done in a strange way you can see on the screenshot, but I am not satisfied with this result as the overall bar height is doubled. I feel like I miss something trivial, can you please suggest a proper way of doing this?

[gsmith]

Hello && Welcome

I see you used Stack.

@ufth

I am not satisfied with this result as the overall bar height is doubled

Could you explain what you mean by height doubled?

EDIT: I did a mockup of your graph and I’m not sure exactly what you want but have you tried to adjust interval?

[ufth]

Hi gsmith and thank you for a quick response. Let me try to describe it in a more verbose way.

Here is an example:

code 200 - 3 requests
code 301 - 1 request
code 304 - 2 requests
code 404 - 1 requests

Total amount of requests: 3+1+2+1 = 7 requests.

I expect to see 7 requests high bar, but I see 14 requests here as count() is painted on top when I use Bar chart with “Stack” mode.

In Kibana with the settings set as on my screenshot posted in my first message the overall height of a bar is correct.

So, my question is - how can I have a correct bar height on a bar chart if I want to split every bar? Maybe there is a way a way to hide
“count()” from chart or to make it transparent or maybe there is another setting I can use to achieve this?

P.S. I also tried an “overlay” mode and does a bit different thing - sections are “swallowed” by each other, colors are strange as “count()” is on top of everting and I can’t make it transparent, but at list the top border is correct… So I wish I can have something I am accustomed to in Kibana.

[nisow95612]

I don’t have any experience with this part of Graylog, but what happens when you uncheck that “Rollup Columns” on top?

[ufth]

Amazing, it works! Thank you very much, nisow95612!

It seems this checkbox is checked automatically when I add “status” as one more “Group by” and then check “Column” direction. I never noticed it. So now, when I uncheck this checkbox manually and update chart - everything works as expected: