Display Container Actions

Display a pie chart of Docker container actions

This is a query example for the Container Actions widget in the Docker Overview dashboard of the docker/metrics package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} result{{Result Set}} repo --> 1 1 --> result

logscale

groupby(docker.event.action)

Introduction

This widget is used to display a pie chart of Docker container actions by grouping events according to the docker.event.action field. It provides an at-a-glance overview of how many times each container action — such as create, die, pause, stop, or update — has occurred within the selected time range, making it easy to identify the relative distribution of container lifecycle activity across action types.

In this widget, the groupBy() function is used to aggregate all incoming Docker events by the value of the docker.event.action field, producing a count of occurrences for each distinct action type. The result is rendered as a pie chart where each slice represents a unique container action and its proportional share of total events, with the raw count stored by default in the field _count.

Example incoming data might look like this:

@timestamp	#repo	#type	@id	@ingesttimestamp	@rawstring	@timezone	@type	_datagen_identifier	agent.type	agent.version	container.id	container.image.name	container.name	docker.container.event.action	docker.container.event.actor.id	docker.container.event.from	docker.container.event.status	docker.container.event.type	docker.diskio.read.bytes	docker.diskio.read.ops	docker.diskio.summary.bytes	docker.diskio.summary.ops	docker.diskio.write.bytes	docker.diskio.write.ops	docker.event.action	docker.healthcheck.event.end_date	docker.healthcheck.event.exit_code	docker.healthcheck.failingstreak	docker.healthcheck.status	docker.image.created	docker.image.id.current	docker.image.id.parent	docker.image.size.regular	docker.image.size.virtual	docker.image.tags[0]	docker.info.containers.paused	docker.info.containers.running	docker.info.containers.stopped	docker.info.containers.total	docker.info.id	docker.info.images	event.dataset	event.module	host.name	metricset.name	service.type
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_11_1773124881	2026-03-10T06:41:21	{"docker.image.id.current":"sha256:abcd1234efgh5678","metricset.name":"image","docker.image.size.regular":"133169152","docker.image.created":"2026-03-10T06:41:21.002Z","event.module":"docker","docker.image.tags":["nginx:latest"],"@timestamp":"2026-03-10T06:41:21.002Z","host.name":"docker-host-01","agent.type":"metricbeat","@type":"docker","event.dataset":"docker.image","agent.version":"7.11.1","docker.image.size.virtual":"133169152","docker.image.id.parent":"sha256:parent1234567890ab","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.11.1																				2026-03-10T06:41:21.002Z	sha256:abcd1234efgh5678	sha256:parent1234567890ab	133169152	133169152	nginx:latest							docker.image	docker	docker-host-01	image	docker
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_12_1773124881	2026-03-10T06:41:22	{"@timestamp":"2026-03-10T06:41:21.801Z","event.module":"docker","host.name":"docker-host-02","container.image.name":"nginx:latest","agent.type":"metricbeat","metricset.name":"event","docker.event.action":"stop","docker.container.event.action":"start","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.container.event.type":"container","docker.container.event.from":"redis:6.2-alpine","container.id":"a1b2c3d4e5f6","container.name":"nginx-web","event.dataset":"docker.event","docker.container.event.status":"Up 2 hours","@type":"docker","agent.version":"7.12.0","docker.container.event.actor.id":"b2c3d4e5f6a7"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.12.0	a1b2c3d4e5f6	nginx:latest	nginx-web	start	b2c3d4e5f6a7	redis:6.2-alpine	Up 2 hours	container							stop																	docker.event	docker	docker-host-02	event	docker
2026-03-10T06:41:22	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_13_1773124882	2026-03-10T06:41:23	{"docker.info.containers.paused":"0","docker.info.images":"15","metricset.name":"info","docker.info.containers.running":"5","agent.type":"metricbeat","host.name":"docker-host-03","event.module":"docker","@timestamp":"2026-03-10T06:41:22.581Z","agent.version":"7.13.2","@type":"docker","event.dataset":"docker.info","docker.info.containers.stopped":"2","docker.info.containers.total":"7","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.info.id":"ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.13.2																										0	5	2	7	ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456	15	docker.info	docker	docker-host-03	info	docker
2026-03-10T06:41:23	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_14_1773124883	2026-03-10T06:41:24	{"container.id":"c3d4e5f6a7b8","container.name":"redis-cache","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.healthcheck.failingstreak":"0","@type":"docker","event.dataset":"docker.healthcheck","agent.version":"7.14.0","agent.type":"metricbeat","container.image.name":"postgres:14","event.module":"docker","@timestamp":"2026-03-10T06:41:23.389Z","host.name":"swarm-manager-01","docker.healthcheck.status":"healthy","docker.healthcheck.event.end_date":"2026-03-10T06:41:23.389Z","metricset.name":"healthcheck","docker.healthcheck.event.exit_code":"0"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.14.0	c3d4e5f6a7b8	postgres:14	redis-cache													2026-03-10T06:41:23.389Z	0	0	healthy													docker.healthcheck	docker	swarm-manager-01	healthcheck	docker
2026-03-10T06:41:24	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_15_1773124884	2026-03-10T06:41:24	{"container.id":"d4e5f6a7b8c9","container.name":"postgres-db","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","docker.diskio.read.ops":"125","docker.diskio.read.bytes":"1048576","docker.diskio.summary.bytes":"3145728","@type":"docker","event.dataset":"docker.diskio","docker.diskio.write.bytes":"2097152","agent.version":"7.15.1","docker.diskio.write.ops":"234","agent.type":"metricbeat","container.image.name":"mongo:5.0","event.module":"docker","@timestamp":"2026-03-10T06:41:24.187Z","host.name":"swarm-worker-01","docker.diskio.summary.ops":"359","metricset.name":"diskio"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.15.1	d4e5f6a7b8c9	mongo:5.0	postgres-db						1048576	125	3145728	359	2097152	234																		docker.diskio	docker	swarm-worker-01	diskio	docker

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} result{{Result Set}} repo --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
groupby(docker.event.action)
```
Groups all events by the value of the docker.event.action field, such as create, die, pause, stop, or update.
For each distinct action value, it counts the number of matching events and returns the result in the automatically created field _count.
By default, when no aggregation function is explicitly specified as a parameter, groupBy() applies an implicit count(), producing one output row per unique group with the event count stored in _count.
Event Result set.

Summary and Results

The widget is used to aggregate Docker container events by action type and render the distribution as a pie chart, providing a concise visual representation of how many times each action — such as create, die, pause, stop, or update — has been recorded within the selected time window.

This widget is useful to operations and platform teams who need to monitor the relative distribution of container lifecycle actions at a glance, quickly identifying which actions dominate activity and whether any unexpected or elevated action counts — such as a high proportion of die or stop events — may indicate instability in the container environment.

Sample output from the incoming example data:

_count	docker.event.action
6	create
6	die
5	pause
6	stop
5	update

The output shows one row per distinct docker.event.action value observed in the data, with the corresponding event count in _count. When rendered as a pie chart, each of these rows becomes a labeled slice showing the action name and its share of total events.

Events that do not carry a docker.event.action field — such as those from the docker.image, docker.info, docker.healthcheck, or docker.diskio datasets — are excluded from the results, as they do not contribute a groupable action value.

Versions of this Page

Examples Library