# Define Aliases for aggregation field

**URL:** <https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853>\
**Category:** Kibana\
**Created:** [June 21, 2018, 12:33pm UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853 "2018-06-21T12:33:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucas.alvarez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas.alvarez/32/33649_2.png) [@lucas.alvarez](https://discuss.elastic.co/u/lucas.alvarez)\
**Post date:** [June 21, 2018, 12:33pm UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853/1 "2018-06-21T12:33:53Z")

</div>

Hello everybody!. Right now I'm facing the following situation:  
I need to create a Timelion graph that displays information from different indices which represent logs taken from different sources. The structure of these indices is not normalized, meaning that not all fields are named exactly the same in all of them.  
I.E: in two of my indices I have a "severity\_label" field used for representing the severity of the log. As possible values for this label, I have: "Warning", "Error", "Critical" and so on.  
However, in another index, these possible set of values is under a field called "level". If I want to create a Timelion graph using split, it will only work for the first two indices and I can accomplish that by writing down the following expression:

.es(index='index1, index2', split=severity\_label:5)

Is there a way I can tell Timelion that I also want to include the third index but the field it should consider for that aggregation is "level" instead of "severity\_label"? It should be something like:

.es(index='index1, index2,index3', split=severity\_label:5, index3.level:5)

---

<div class="post-metadata">

**Author:** ![lucas.alvarez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas.alvarez/32/33649_2.png) [@lucas.alvarez](https://discuss.elastic.co/u/lucas.alvarez)\
**Post date:** [June 21, 2018, 2:50pm UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853/2 "2018-06-21T14:50:44Z")

</div>

I found a way to do this by using scripted fields. Don't know if it's the best solution though.

---

<div class="post-metadata">

**Author:** ![a5a](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@a5a](https://discuss.elastic.co/u/a5a)\
**Post date:** [June 21, 2018, 7:48pm UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853/3 "2018-06-21T19:48:36Z")

</div>

You're on the right path. Using the scripted field gets you there without having to reindex your data in Elasticsearch so that the fields are the same. If you're ever interested in doing that, [there are docs to help you](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/docs-reindex.html). The script portion of your reindex in order to change the name of the field would be like:

```auto
"script": {
  "inline": "ctx._source['level'] = ctx._source.remove('severity_label');"
}

```

or vice-versa depending on which field you want to rename to.

---

<div class="post-metadata">

**Author:** ![lucas.alvarez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas.alvarez/32/33649_2.png) [@lucas.alvarez](https://discuss.elastic.co/u/lucas.alvarez)\
**Post date:** [June 25, 2018, 11:31am UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853/4 "2018-06-25T11:31:32Z")

</div>

Thanks for your reply!. The problem I'm having right now is that apparently scripted fields cannot be aggregated within different indices.  
Following the same example I mentioned before, I now have 3 indices (that represent different types of logs) that contain a field called "severity\_label". However, in one of them, "severity\_label" is a scripted field.

When I try to write a Timelion expression for splitting these 3 indices based on the field "severity\_label", I'm getting the aggregation but only for the first two indices, the ones where the field is not scripted.  
The one that contains "severity\_label" as a scripted field does not appear in the visualization.

Are there any workarounds for this?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2018, 11:45am UTC](https://discuss.elastic.co/t/define-aliases-for-aggregation-field/136853/6 "2018-07-23T11:45:55Z")

</div>

Closed on July 23, 2018, 11:45am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.