# Extract value from field for visualization

**URL:** <https://discuss.elastic.co/t/extract-value-from-field-for-visualization/166842>\
**Category:** Kibana\
**Created:** [February 3, 2019, 12:34am UTC](https://discuss.elastic.co/t/extract-value-from-field-for-visualization/166842 "2019-02-03T00:34:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![j0ebeer](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@j0ebeer](https://discuss.elastic.co/u/j0ebeer)\
**Post date:** [February 3, 2019, 12:34am UTC](https://discuss.elastic.co/t/extract-value-from-field-for-visualization/166842/1 "2019-02-03T00:34:18Z")

</div>

Is it possible to extract from a parsed field and then visualize that number? Example, I want to show my firewall's current user session and that is already parsed out as Subject but I don't want the whole message, just the number of concurrent sessions.

Below is the log. It shows as indexed subject and I can create a graph showing how many messages contain "concurrent sessions" but what I really want is a graph dial showing the number 170.

subject Performance statistics: average CPU: 0, memory: 20, concurrent sessions: 170, setup-rate: 5

Possible? Cheers...

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 3, 2019, 1:27am UTC](https://discuss.elastic.co/t/extract-value-from-field-for-visualization/166842/2 "2019-02-03T01:27:24Z")

</div>

You should really do that before sending it to Elasticsearch. You might be able to do this with a script, but it'd be messy and expensive.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2019, 1:27am UTC](https://discuss.elastic.co/t/extract-value-from-field-for-visualization/166842/3 "2019-03-03T01:27:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
