Aggregate/visualize based on substring or regex query

Elastic Stack Kibana
1

Hey all -

I have a use case where I need to query for a substring or regex pattern from a field, then visualize it in Kibana.

I have a field called "description" in an index, in which various data is stored. The data follows this pattern:

application_name - metric : value

application_name, metric, and value can all vary depending on the source of the data, so what I want to do is pull out application_name, then build a vertical bar chart showing the Count of different application_name values we receive. So for instance:

application_name1 = 30 events last 24 hours
application_name2 = 72 events last 24 hours
application_name3 = 13 events last 24 hours

Unfortunately I don't have a way to change the source, otherwise I would split up the data into individual fields and that would make things a lot easier.

Is this feasible?

2

Hi @sdberts,

Have you tried to extract application name in a dedicated scripted field? Then you can apply any aggregations (incl. count) on this new field.

Best, Oleg