# Create Kibana vizualiation based on keywords matched from message column
**URL:** https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145
**Category:** Kibana
**Created:** [October 3, 2019, 10:05am UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145 "2019-10-03T10:05:54Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@O\_K](https://discuss.elastic.co/u/O_K)
#### Post date: [October 3, 2019, 10:05am UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/1 "2019-10-03T10:05:54Z")
I know it's very easy to create visualizations based on predefined columns, but I wonder what is the proper way to create visualization based on some words from messages? Please share any useful guidance or tip about this
---
### Author:  [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [October 4, 2019, 8:34pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/2 "2019-10-04T20:34:48Z")
Could you provide some sample messages and a general idea of the output you're looking for?
---
### Author:  [@O\_K](https://discuss.elastic.co/u/O_K)
#### Post date: [October 6, 2019, 8:53am UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/3 "2019-10-06T08:53:53Z")
Thanks @mattkime, this is mostly fluend stuff, but probably you have an idea how to deal with this.
Below is a fluend grok filter which creates additional fields: **app\_timestamp, app\_log\_level, app\_message**.
What I'd like to have is additionally parsed **app\_message** field which seems to be json+raw data. So as a result it would be possible to create visualization based on values **legalForm, legalName,** from field **app\_message**
```
#@id filter_parser
@type parser
key_name log
reserve_data true
reserve_time true
@type grok
grok_failure_key grokfailure
pattern %{TIMESTAMP_ISO8601:app_timestamp}" level\=%{DATA:app_log_level} msg\=%{GREEDYDATA:app_message}
```
app\_message field example:
```
Create data draft in db: DatasetDraftVO(id=d57f73fc547f, datasetVO=null, entityId=legalEntityId, datasetVersion=1, data=VerifiableCredential(contexts=[https://www.w3.org/2018/credentials/v1, https://app.com/api/v1], id=le_cd_1, types=[VerifiableCredential,credentialSubject={"corporateData":{"bylaws":{"value":""},"language":{"value":"English"},"legalForm":{"value":"Private limited company"},"legalName":{"value":"CompanyName1"},"companyEmail":{"value":"test@mail.com"},"companyWebsite":{"value":"MyProgram.fr"},"country":{"value":"France"},"mailbox":{"value":"444"},"zipCode":{"value":"2000"}} proofs=null), draftStatus=DRAFT)
```
---
### Author:  [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [October 6, 2019, 7:11pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/4 "2019-10-06T19:11:58Z")
There's a large number of ways this data could be visualized. Do you want to see a graph of documents over time?
If you'd like to browse some ideas you can look at kibana sample data - [https://www.elastic.co/guide/en/kibana/current/add-sample-data.html](https://www.elastic.co/guide/en/kibana/current/add-sample-data.html)
---
### Author:  [@O\_K](https://discuss.elastic.co/u/O_K)
#### Post date: [October 7, 2019, 11:55am UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/5 "2019-10-07T11:55:58Z")
Thank you, @mattkime, should I parse below string into separate fields further in order to have option to create a dashboard based on keywords like
"country":{"value":"France"}
"country":{"value":"England"}
> Create data draft in db: DatasetDraftVO(id=d57f73fc547f, datasetVO=null, entityId=legalEntityId, datasetVersion=1, data=VerifiableCredential(contexts=[[https://www.w3.org/2018/credentials/v1](https://www.w3.org/2018/credentials/v1), [https://app.com/api/v1](https://app.com/api/v1)], id=le\_cd\_1, types=[VerifiableCredential,credentialSubject={"corporateData":{"bylaws":{"value":""},"language":{"value":"English"},"legalForm":{"value":"Private limited company"},"legalName":{"value":"CompanyName1"},"companyEmail":{"[value":"test@mail.com](mailto:value%22:%22test@mail.com)"},"companyWebsite":{"value":"[MyProgram.fr](http://MyProgram.fr)"}, **"country":{"value":"France"}** ,"mailbox":{"value":"444"},"zipCode":{"value":"2000"}} proofs=null), draftStatus=DRAFT)
---
### Author:  [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [October 7, 2019, 6:27pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/6 "2019-10-07T18:27:39Z")
Yes, I'd recommend that. Generally speaking its a good idea to think of Kibana as displaying elasticsearch queries - if you can simplify the query by doing some upfront data parsing you'll likely save yourself a lot of work further down the line.
---
### Author:  [@O\_K](https://discuss.elastic.co/u/O_K)
#### Post date: [October 7, 2019, 6:41pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/7 "2019-10-07T18:41:04Z")
ok, so without fluent or logstash there is no way to do this, is that correct?
---
### Author:  [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [October 7, 2019, 6:45pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/8 "2019-10-07T18:45:25Z")
There may be other solutions but they become increasingly difficult or inflexible. Perhaps a scripted field is worth considering - [https://www.elastic.co/guide/en/kibana/current/scripted-fields.html](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2019, 6:45pm UTC](https://discuss.elastic.co/t/create-kibana-vizualiation-based-on-keywords-matched-from-message-column/202145/9 "2019-11-04T18:45:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.