# Aggregation and sub-aggregation using an array of strings

**URL:** <https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302>\
**Category:** Kibana\
**Created:** [October 29, 2015, 8:34pm UTC](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302 "2015-10-29T20:34:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![abierbaum](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abierbaum/32/4510_2.png) [@abierbaum](https://discuss.elastic.co/u/abierbaum)\
**Post date:** [October 29, 2015, 8:34pm UTC](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302/1 "2015-10-29T20:34:43Z")

</div>

I have a string field that is a dot separated name representing a hierarchy in my logging. ex ("top\_level.next\_level.more"). I would like to do a visualization where I can see the relative size of multiple parts of the hierarchy.

I started by splitting the field in logstash into a an array field (ex: ["top\_level","next\_level","more"]).

I would like a way to visualize the levels and counts in a pie chart visualization but I can't figure out how to make the Terms aggregations access a specific element in the split\_names array. Is this possible? Any other ideas how to do this type of thing?

Thanks.

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [November 5, 2015, 5:10am UTC](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302/2 "2015-11-05T05:10:31Z")

</div>

Arrays and other nested structures are not well-supported in Kibana at the moment. I'd recommend indexing these values as separate fields for now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:09pm UTC](https://discuss.elastic.co/t/aggregation-and-sub-aggregation-using-an-array-of-strings/33302/3 "2017-07-06T14:09:54Z")

</div>