{
  "_index": "filebeat-6.5.2-2018.12.13",
  "_type": "doc",
  "_id": "-Z9Ap2cBI_XuAVP8QgYj",
  "_version": 1,
  "_score": null,
  "_source": {
    "offset": 2508,
    "apache2": {
      "access": {
        "referrer": "http://localhost/test/admin.php?username=root&db=mysite",
        "response_code": "200",
        "remote_ip": "127.0.0.1",
        "method": "GET",
        "user_name": "-",
        "http_version": "1.1",
        "body_sent": {
          "bytes": "4180"
        },
        "url": "/test/admin.php?username=root&db=mysite&script=db",
        "user_agent": {
          "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0",
          "major": "63",
          "minor": "0",
          "os": "Ubuntu",
          "name": "Firefox",
          "os_name": "Ubuntu",
          "device": "Other"
        }
      }
    },
    "prospector": {
      "type": "log"
    },
    "read_timestamp": "2018-12-13T10:56:32.756Z",
    "source": "/var/log/apache2/access.log",
    "fileset": {
      "module": "apache2",
      "name": "access"
    },
    "input": {
      "type": "log"
    },
    "@timestamp": "2018-12-13T08:03:29.000Z",
    "beat": {
      "hostname": "DLILPTP0305",
      "name": "DLILPTP0305",
      "version": "6.5.2"
    },
    "host": {
      "name": "DLILPTP0305"
    }
  },
  "fields": {
    "@timestamp": [
      "2018-12-13T08:03:29.000Z"
    ]
  },
  "highlight": {
    "apache2.access.method": [
      "@kibana-highlighted-field@GET@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1544688209000
  ]
}

The above document of the filebeat index is showing the metrics of Apache log data. So I will use the fields from this document in order to create the pie chart. We need to do the following for creating the chart:

• Click on Visualize link from the left menu. This will open the save visualization link.
• Click on the plus icon the create a new visualization.
• From Select visualization type screen, click on the pie chart box. This will open a screen to select the index or saved search object.
• Click on Filebeat if you have a Filebeat index or choose your own index pattern.
• Select count under the "Metrics" option.
• Under Buckets option, select terms for aggregation and select the response_code field of Apache under field option.
• Add the custom label as per the field name.
• Now click on the "Add sub-buckets" button to add more fields to aggregate.
• Add HTTP method and total bytes sent field for aggregation.
• After adding all these fields click on the "Apply Changes" button icon on the configuration panel.

This will load the visualization as shown in the below screen-shot.

We can click on any section of the visualization to drill-down into the chart and in this way we can get the desired set of data using the visualization. For example, if we want to see only POST requests with response code 302, we can directly click on these sections to filter out the chart. 

If you found this article interesting, then you can explore “Mastering Kibana 6.0”, “Kibana 7 Quick Start Guide”, “Learning Kibana 7”, and “Elasticsearch 7 Quick Start Guide” books to get more insight about Elastic Stack, how to perform data analysis, and how you can create dashboards for key performance indicators using Kibana.