# Aggregate fields in a single field

**URL:** <https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542>\
**Category:** Kibana\
**Created:** [November 29, 2017, 9:04am UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542 "2017-11-29T09:04:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gius78](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@gius78](https://discuss.elastic.co/u/gius78)\
**Post date:** [November 29, 2017, 9:04am UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/1 "2017-11-29T09:04:46Z")

</div>

Hi all the forum from an elastic newbie.

I have different applications sending logs to logstash-kibana, each application has different fields in logs obviously, I'd like to aggregate fields containing same informations (for example name-surname of users)

I've tried the "copy" function:

```
PUT my_index/_mapping/user
{
       "properties": {
        "application1_name": {
          "type": "text",
          "copy_to": "universal_name" 
        },
        "application2_name": {
          "type": "text",
          "copy_to": "universal_name" 
        },
        "universal_name": {
          "type": "text"
        }
      }
    }
}

```

I have then refreshed my index but new "universal name" field does not show up.

First of all, I did not understood so much how my user defined indexes integrate with the "logstash\*" auto generated indexes. I have always the feeling that documentation refers to knowledge I don't have.

Another thing, I'll probably have to aggregate other applications in the same fields, in the future. So I dunno if this solution is good, looks quite static.

thanks to all

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [November 29, 2017, 10:07pm UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/2 "2017-11-29T22:07:52Z")

</div>

The universal\_name field won't show up in \_source, but it will return documents for terms queries of application1 and application2 names.

If you're storing these logs all in the same index, is a single application\_name field an option? It's value can then be application1, application2, etc.

---

<div class="post-metadata">

**Author:** ![gius78](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@gius78](https://discuss.elastic.co/u/gius78)\
**Post date:** [November 30, 2017, 8:20am UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/3 "2017-11-30T08:20:54Z")

</div>

Hi, thanks for reply.  
When you say "universal\_name field won't show up in \_source" i am afraid of not knowing what is \_source, I just wanted to have universal\_name in the list of selectable fields in kibana, a field containing all usernames of the various applications.  
Yes all applications are stored in the same logstash index, the fields have different names even if all share the same information (for example: user name and surname) probably I could name in the same way with a mutate in the logstash configuration, but I preferred another way.

Edit: Ok now I got what \_source is, ok I don't expect universal\_name being shown there, but i'd like to see in the list on the left.

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [November 30, 2017, 7:14pm UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/4 "2017-11-30T19:14:42Z")

</div>

Unfortunately the list on the left is built from \_source in the browser. To get it to show up we'll have to write to it ourselves or create a scripted field.

1. Like you mentioned - at ingestion time, using the logstash copy filter [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-copy](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-copy)
2. At search time in Kibana with a scripted field: from the index pattern's page, click on the scripted fields tab and add new:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/6/36243770596e742b5f71633558eded1735304591.png)

```auto
if (!doc['application_name1'].empty) {
  return doc['application_name1'].value;
} else if (!doc['application_name2'].empty) {
  return doc['application_name2'].value;
} else {
  return null;
}

```

---

<div class="post-metadata">

**Author:** ![gius78](https://avatars.discourse-cdn.com/v4/letter/g/7ea924/32.png) [@gius78](https://discuss.elastic.co/u/gius78)\
**Post date:** [December 1, 2017, 4:17pm UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/5 "2017-12-01T16:17:28Z")

</div>

Thanks again for the reply,

I created the scripted field, refreshed my index (dunno if necessary) but now zero documents are found in the discover, plus I get some kind of "shards error" in the top of the page (5 errors)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2017, 4:17pm UTC](https://discuss.elastic.co/t/aggregate-fields-in-a-single-field/109542/6 "2017-12-29T16:17:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.