Aggregations on basis of field prefix

Elastic Stack Kibana
1

Hi All,
I want to know that if we can make buckets in Kibana on basis of field names' prefix?
For example.
I have a database in elasticsearch which has data for different shops and restaurants. documents contain a field name which has shop-abc or shop-xyz for shops and restaurant-abc or restaurant-xyz for restaurants.

I can visualize the income from each separate shop and restaurant in Kibana.
But,
I want to visualize the earning from all the shops and all the restaurants collectively in Kibana, I will have to first make a bucket for all the shops and all the restaurants and then I can sum up their income.

I want to know if I can make buckets on basis of prefix e.g shop-* and restaurant-* in Kibana manually as the GUI does not support this. What Kibana supports is that it will make a separate bucket for each shop and each restaurant.

Any help would be highly appreciated.

1 Like
2

What sort of visualisation are you trying to build with this>?

3

I would recommend creating a separate, not analysed field on indexing that contains the category you want to group by, as this is likely to perform and scale better than trying to parse fields at query time.

4

Hi Mark!
I am trying to show vertical bar charts to show the revenue generated by all the shops in one bar and revenue generated by all different restaurants in single bar.
So i need to sum all the revenue from every shop and then sum all the revenue from all the restaurants.
There are several shops and several restaurants in single index but shops have a prefix of shop- and restaurants have a prefix of restaurant- before their names, so i was wondering if i could make one bucket for all the shops and one for all the restaurants to achieve this.

5

You should be able to do this with a bar chart, then use the sum agg, and finally split the bars and do a filter agg and have one for shop-* and another for restaurant-*.