Aggregate text values of each bucket in Data Table Visualization

(Hoan Le) #1

I have following sample data which include two fileds src_address and threat_name,

src_address | threat_name | virus_infected | port_scan | botnet_call_home | suspicious_dns_request

How can I aggregate and visualize to get following display ?

src_address | threat_name | virus_infected, port_scan | botnet_call_home, suspicious_dns_request

Many thanks !

(Felix Stürmer) #2

Hi @Hoan_Le,

this looks like a data table visualization with a src_address Terms aggregation as the buckets and a Top Hit aggregation on threat_name as the metric. It could be configured something like this (with different field names, obviously):

(Hoan Le) #3

thank you Weltenwort,

Agrregation with Top Hit is great way. But can we dedup duplicate values "in the Last 5 match.os" columns ?

(Felix Stürmer) #4

Unfortunately I can not think of a way to achieve that right now. Only simple concatenation is supported for the top hit results. It would make a good enhancement request, which you can file in Kibana's GitHub repository.

(Hoan Le) #5

Thank you for your replies, Weltenwort

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.