# Bucket the most 10 popular terms using a scripted field

**URL:** <https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [January 27, 2021, 12:59pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369 "2021-01-27T12:59:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [January 27, 2021, 12:59pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369/1 "2021-01-27T12:59:51Z")

</div>

Hi there,  
I am a bit struggling getting this right.  
I have some log messages, What I need to do is to look for log.message, get the first 15 characters and display the most 10 popular messages.  
What I did so far is create a scripted field and retrieve log.message and trunc it to 15 characters. Nevertheless, while displaying in a chart, kibana still considers it as different. For example

This is a log message ABC  
This is a log message CBA  
This is a log message BBB  
This is a log message ABC

If I query the script, it shows as  
This is a log m...  
This is a log m...  
This is a log m...

And if I do a count and display it in a bar chart, I see them as independent categories, the exactly repeated ones in one category, but I would also like to see the rest based on the script.

Any other way I can do this? or to make this work?

---

<div class="post-metadata">

**Author:** ![stu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stu/32/75063_2.png) [@stu](https://discuss.elastic.co/u/stu)\
**Post date:** [February 18, 2021, 3:04pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369/2 "2021-02-18T15:04:37Z")

</div>

What you want is doable with a [terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-script) and a script.

Can can post the graph you're generating and highlight the problems?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2021, 3:05pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369/3 "2021-03-18T15:05:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
