# Discover query but only show the first line of a field

**URL:** <https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917>\
**Category:** Kibana\
**Created:** [August 31, 2018, 9:01pm UTC](https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917 "2018-08-31T21:01:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [August 31, 2018, 9:01pm UTC](https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917/1 "2018-08-31T21:01:46Z")

</div>

Hi, I'm a Kibana newbie but used to work in Splunk and I'm trying to put together a saved search but one of the fields I'm trying to query has at times multiple lines in that field. The field in question mostly has all the data in one line but sometimes it's multiple lines so it throws off the formatting. This will be for a dashboard I'm creating.

Is there a way in the query to say give me just the first line of this field without having to change anything on the back end?

Thanks!

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [September 1, 2018, 3:09am UTC](https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917/2 "2018-09-01T03:09:20Z")

</div>

Unfortunately you will need to change this at index time. You can either change this where it's being sent to Elasticsearch, implement a pipeline in Elasticsearch, or use Logstash.

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [September 4, 2018, 12:45pm UTC](https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917/3 "2018-09-04T12:45:06Z")

</div>

That's what I was thinking. Thanks for the reply!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2018, 12:45pm UTC](https://discuss.elastic.co/t/discover-query-but-only-show-the-first-line-of-a-field/146917/4 "2018-10-02T12:45:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.