Combine results for user_agent.device.name from Apache logs

How would I combine these results into a single item for all Samsung devices?

You need a field that just holds the term you want to see in your chart.

This can be done either before your documents are actually ingested in Elasticsearch (e.g. using an ingest pipeline or Logstash), or on the fly in Kibana (with a performance penalty) using scripted fields: https://www.elastic.co/guide/en/kibana/current/scripted-fields.html

1 Like