# Aggregation of Regex of Terms **URL:** \ **Category:** Kibana\ **Created:** [March 29, 2016, 5:36pm UTC](https://discuss.elastic.co/t/aggregation-of-regex-of-terms/45717 "2016-03-29T17:36:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\ **Post date:** [March 29, 2016, 5:36pm UTC](https://discuss.elastic.co/t/aggregation-of-regex-of-terms/45717/1 "2016-03-29T17:36:37Z")
I have some textual data (snort alert messages) I would like to do a regex of a field and then an aggregation (count by day) of the results of that regex'd field. For instance: data: "01/01/2016","WEB more words here" "01/01/2016","WEB different words" "01/01/2016","MS-SQL woooorrrddssss" I regex out to just the Caps bit at the beginning to get for that day: "WEB",2 "MS-SQL",1 I can't quite figure out if Kibana can DO that, or how to do it if it can. ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [March 29, 2016, 8:31pm UTC](https://discuss.elastic.co/t/aggregation-of-regex-of-terms/45717/2 "2016-03-29T20:31:28Z")
If you want to parse out a specific field and then do aggregations on it, the parsing step needs to happen prior to indexing the data in Elasticsearch. In ES 1.x and 2.x (currently shipping versions), grok filter in Logstash can do it, or in 5.0 (still in development) Ingest Node in Elasticsearch will contain a grok pipeline step. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:57pm UTC](https://discuss.elastic.co/t/aggregation-of-regex-of-terms/45717/3 "2017-07-06T13:57:29Z")