Custom Label in Legend for Pie Chart

So I have a field called logMessage. It looks like this:

"Connection Terminated: book read from //host/stuff_stuff:4294967295 failed (-268500976) (0) [file.c][2412]"

I want to make a pie chart with split slices on the the log messages. I want the label of each one to be the highlighted part of the message above


As you can see in the picture all messages start with Connection Terminated. I know that you can make custom labels in the Timelion tool with regexs and was wondering if it was possible to do that with pie charts as well?


Why not parse out host into a separate field at indexing time and use this for the visualisation?

Long story short, it is not worth all the extra work for how much the log message appears/is used. It's not a deal breaker, otherwise I would implement it that way. I was wondering if there was an easy way to do this since the Timelion feature has it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.