The Date Histogram: patterns over time
What is it?
A date histogram buckets documents into time intervals (per minute, per hour) and counts each bucket, optionally split by a field. It is the Elastic equivalent of Splunk's timechart — the way you turn time into a visible shape.
Why it matters
Some signals live only in time. A beacon — a host calling home on a fixed interval — is invisible in a document list and under a volume alert, but a per-minute histogram draws it as a flat, evenly-spaced line.
Where you see it
A date histogram with a 1-minute interval, split by destination.domain, over a workstation's proxy events: the malicious destination shows the same small count every minute; normal browsing is irregular.
What normal looks like
An irregular histogram that follows human rhythm — busy hours, quiet nights, uneven bars. Real activity is bursty, not metronomic.
What suspicious looks like
A destination whose bar is the same height in every single interval — a machine cadence. The regularity, not the volume, is the tell; beacons carry almost no data.
How analysts investigate
Add a date histogram with a small interval, split by the entity in question, and look for a bar that repeats identically. Then confirm it is not a legitimate scheduled job before escalating.
Common beginner mistakes
- Using an interval too coarse (per hour) to reveal a per-minute beacon.
- Calling every regular pattern malicious — backups and sync jobs are regular too; validate first.
Regularity in time is the signal
Date histogram, interval 1m, split by destination.domain:
cdn-updates.example ▂▅▁▇▂▁▅ ← irregular = human/app browsing
sync-node7.example ▁▁▁▁▁▁▁ ← exactly 1 every minute = a beacon
volume is tiny, so a bandwidth alert never fires — the RHYTHM is the tell
(this is Splunk's timechart span=1m, in Elastic)Quick check
A host connects to one domain with the same tiny count every minute. Which Elastic view makes it obvious?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.