# Advanced JSON input

**URL:** https://discuss.elastic.co/t/advanced-json-input/322366
**Category:** Kibana
**Created:** [January 3, 2023, 11:52am UTC](https://discuss.elastic.co/t/advanced-json-input/322366 "2023-01-03T11:52:29Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![imsudo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imsudo/32/115488_2.png) [@imsudo](https://discuss.elastic.co/u/imsudo)
#### Post date: [January 3, 2023, 11:52am UTC](https://discuss.elastic.co/t/advanced-json-input/322366/1 "2023-01-03T11:52:29Z")

</div>

I have a data table with data, Metrics, aggregation as count. ( as it shows all the log count)  
see attached image(if avl)

i wish to get only the count of 5xx errors (500-599) in downstreamStatus data field using advanced json input field.  
i have downstreamStatus as data field in filter field, but do not wish to apply that in "add filter" section.

is this achievable using advanced JSON input field ?

 ![Screenshot 2023-01-03 at 11.46.36](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d87b8a0ef70521807c4c7d31e94af5124008602.jpeg)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 3, 2023, 11:25pm UTC](https://discuss.elastic.co/t/advanced-json-input/322366/2 "2023-01-03T23:25:58Z")

</div>

Hi @imsudo Welcome to the community!

What version of the Stack...

Lens you can put the KQL filter in the aggregation formulas.

In general if you are on a newer version you should start with Lens

Or using the legacy Table you can base the viz on a saved search

---

<div class="post-metadata">

### Author: ![imsudo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imsudo/32/115488_2.png) [@imsudo](https://discuss.elastic.co/u/imsudo)
#### Post date: [January 11, 2023, 1:17pm UTC](https://discuss.elastic.co/t/advanced-json-input/322366/3 "2023-01-11T13:17:38Z")

</div>

hi @stephenb  
It's v 7.7.0

so how can i base the viz on saved search.. ?

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 11, 2023, 2:42pm UTC](https://discuss.elastic.co/t/advanced-json-input/322366/4 "2023-01-11T14:42:30Z")

</div>

Go to Discover  
set the index pattern  
Set the filters  
Save  
Then use that saved search when creating the visualization.

BTW 7.7 is incredibly old and you should upgrade as soon as possible.

---

<div class="post-metadata">

### Author: ![imsudo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/imsudo/32/115488_2.png) [@imsudo](https://discuss.elastic.co/u/imsudo)
#### Post date: [January 18, 2023, 7:26pm UTC](https://discuss.elastic.co/t/advanced-json-input/322366/5 "2023-01-18T19:26:20Z")

</div>

i did google version 7.7.0 is on 13th May 2020...

i tried but in Visualization - new Visualization - data table - choose source and .......... same place.. no option to use the saved one

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 19, 2023, 2:08am UTC](https://discuss.elastic.co/t/advanced-json-input/322366/6 "2023-01-19T02:08:05Z")

</div>

> [@imsudo](#):
>
> i did google version 7.7.0 is on 13th May 2020...

Yes, that is nearly 3 Years old and over 15+ Significant Releases behind... just a suggestion.

Hmmm Right Here in the 7.7 [Docs](https://www.elastic.co/guide/en/kibana/7.7/most-frequent.html)

> The most frequently used visualizations allow you to plot aggregated data from a \>\>[saved search](https://www.elastic.co/guide/en/kibana/7.7/save-open-search.html)\<\< or [index pattern](https://www.elastic.co/guide/en/kibana/7.7/index-patterns.html).
> 
> The most frequently used visualizations include:
> 
> - Line, area, and bar charts
> - Pie chart
> - Data table
> - Metric, goal, and gauge
> - Tag cloud

So here is my 7.7 works fine

Discover

 ![Screen Shot 2023-01-18 at 6.02.13 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/2/025f0aab9fcc8c3fc8cdbf724fb8abb4356e2d16.jpeg)

 ![Screen Shot 2023-01-18 at 6.02.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e64cf9c42abf6b293297fdaa9e68156f1948947.jpeg)

Data Table

 ![Screen Shot 2023-01-18 at 6.02.46 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e59aa6705f39c47337330dc12cbaa1312820a20a.png)

Pick the Saved Search

 ![Screen Shot 2023-01-18 at 6.02.59 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/2/520883a3a857889d36385364250d492ef4e9b8d6.png)

Build Table off Saved Search

 ![Screen Shot 2023-01-18 at 6.03.52 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c0ab3f0bee390f17c1f8d69fac1ff8f10dba0190.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2023, 2:08am UTC](https://discuss.elastic.co/t/advanced-json-input/322366/7 "2023-02-16T02:08:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
