I am want to build a Gantt Diagram to see users connected to WireGuard in real-time. Logs are created by mine python script so I could make changes to it if needed.

Events are going to look like this:
enter image description here

* log_in_time and log_out_time is in unix format

Logs are look like this:

May 10 15:49:13 wireguard: erste has logged_in log_in_time 1715356153 log_out_time 0 from 172.17.0.180 port 56750 May 10 15:52:13 wireguard: erste has logged_out log_in_time 1715356153 log_out_time 1715356333 from 172.17.0.180 port 56750 May 10 16:25:16 wireguard: erste has logged_in log_in_time 1715358316 log_out_time 0 from 172.17.0.180 port 65242

and Vega code looks like this:

{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "title": "Gantt diagram users online using VPN",
  "data": {
    "url": {
      "%context%": true,
      "%timefield%": "@timestamp",
      "index": "wazuh-alerts-*",
      "body": {
        "size": 10000
      }
    },
    "format": {"property": "hits.hits"}
  },
  
  "transform": [
    {
      "aggregate": [{
          "op": "max",
          "field": "_source.data.log_out_time",
          "as": "max_log_out_time"
      }],
      "groupby": [
        "_source.data.dstuser",
        "_source.data.log_in_time"
      ]
    },
    {
      "calculate": "toDate(datum._source.data.log_in_time)",
      "as": "log_in_time"
    },
    {
     "calculate": "if(max_log_out_time == 0, now(), max_log_out_time)",
      "as": "actual_unix_log_out_time"
    },
    {
      "calculate": "toDate(datum.actual_unix_log_out_time)",
      "as": "actual_log_out_time"
    },
  ],
  
  "layer": [
    {
      "mark": "bar",
      "encoding": {
        "y": {
          "field": "_source.data.dstuser", 
          "type": "ordinal", 
          "title": "User"
        },
        "x": {
          "field": "log_in_time", 
          "type": "temporal",  
          "title": "Time", 
          "axis": {
            "format": "%a %H:%M"
          }
        },
        "x2": {
          "field": "actual_log_out_time", 
          "type": "temporal"
        },
        "tooltip": [
          {
            "field": "_source.data.dstuser", 
            "title": "User"
          },
          {
            "field": "log_in_time",
            "timeUnit": "datemonthhoursminutes", 
            "title": "Logged in"
          },
          {
            "field": "actual_log_out_time", 
            "timeUnit": "datemonthhoursminutes", 
            "title": "Logged out"
          },
          // {"field": "agg", "title": "agg"}
        ],
        "color": {
          "field": "_source.data.dstuser",
          "type": "nominal",
          "title": "User"
        }
      }
    }
  ]
}

Current error is:

Unrecognized signal name: "max_log_out_time"

What can I do to make it work?

I have tried similar aggregation on another data and it was just fine so I don’t think it is the issue. Probably something with log_in_time and log_out_time but I have no idea how to fix it.