# Aggregate text values of each bucket in Data Table Visualization

**URL:** https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500
**Category:** Kibana
**Created:** [August 28, 2017, 3:22am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500 "2017-08-28T03:22:32Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Hoan\_Le](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoan_le/32/50270_2.png) [@Hoan\_Le](https://discuss.elastic.co/u/Hoan_Le)
#### Post date: [August 28, 2017, 3:22am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/1 "2017-08-28T03:22:32Z")

</div>

I have following sample data which include two fileds src\_address and threat\_name,

## src\_address | threat\_name

10.1.1.2 | virus\_infected  
10.1.1.2 | port\_scan  
10.1.1.3 | botnet\_call\_home  
10.1.1.3 | suspicious\_dns\_request

How can I aggregate and visualize to get following display ?

## src\_address | threat\_name

10.1.1.2 | virus\_infected, port\_scan  
10.1.1.3 | botnet\_call\_home, suspicious\_dns\_request

Many thanks !

---

<div class="post-metadata">

### Author: ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [August 30, 2017, 8:36am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/2 "2017-08-30T08:36:20Z")

</div>

Hi @Hoan_Le,

this looks like a data table visualization with a `src_address` `Terms` aggregation as the buckets and a `Top Hit` aggregation on `threat_name` as the metric. It could be configured something like this (with different field names, obviously):

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/0/b0ac77f66a52d6c1ae4822c741684eab75aa4ce2.png)

---

<div class="post-metadata">

### Author: ![Hoan\_Le](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoan_le/32/50270_2.png) [@Hoan\_Le](https://discuss.elastic.co/u/Hoan_Le)
#### Post date: [August 30, 2017, 10:50am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/3 "2017-08-30T10:50:31Z")

</div>

thank you Weltenwort,

Agrregation with Top Hit is great way. But can we dedup duplicate values "in the Last 5 match.os" columns ?

---

<div class="post-metadata">

### Author: ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [August 30, 2017, 12:07pm UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/4 "2017-08-30T12:07:04Z")

</div>

Unfortunately I can not think of a way to achieve that right now. Only simple concatenation is supported for the top hit results. It would make a good enhancement request, which you can file [in Kibana's GitHub repository](https://github.com/elastic/kibana/issues/new).

---

<div class="post-metadata">

### Author: ![Hoan\_Le](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoan_le/32/50270_2.png) [@Hoan\_Le](https://discuss.elastic.co/u/Hoan_Le)
#### Post date: [August 31, 2017, 2:18am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/5 "2017-08-31T02:18:25Z")

</div>

Thank you for your replies, Weltenwort

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2017, 2:18am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500/6 "2017-09-28T02:18:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.