Aggregate/visualize based on substring or regex query

Hey all -

I have a use case where I need to query for a substring or regex pattern from a field, then visualize it in Kibana.

I have a field called "description" in an index, in which various data is stored. The data follows this pattern:

application_name - metric : value

application_name, metric, and value can all vary depending on the source of the data, so what I want to do is pull out application_name, then build a vertical bar chart showing the Count of different application_name values we receive. So for instance:

application_name1 = 30 events last 24 hours
application_name2 = 72 events last 24 hours
application_name3 = 13 events last 24 hours

Unfortunately I don't have a way to change the source, otherwise I would split up the data into individual fields and that would make things a lot easier.

Is this feasible?

Hi @sdberts,

Have you tried to extract application name in a dedicated scripted field? Then you can apply any aggregations (incl. count) on this new field.

Best, Oleg

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.