# Extracting a portion of a field in kibana
**URL:** https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866
**Category:** Kibana
**Created:** [September 19, 2016, 10:08am UTC](https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866 "2016-09-19T10:08:02Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sabyasachi\_mallick](https://discuss.elastic.co/u/sabyasachi_mallick)
#### Post date: [September 19, 2016, 10:08am UTC](https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866/1 "2016-09-19T10:08:03Z")
i am visualizing syslogs in kibana. i am getting messages under syslog\_message field.I want to visualize the count of a portion of message . e.g in below line i wan to count total number of cdp/interface portion..there may be something different in that [portion.So](http://portion.So) i want to visualize count of that portion.But i dont know what will appear over there thats why i cant use filtering.
syslog\_message:[cdp/interface.ERR] - {- -} Error writing CDP frame
is there any way to do that in kibana?
---
### Author:  [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [September 19, 2016, 2:56pm UTC](https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866/2 "2016-09-19T14:56:08Z")
If the whole syslog entry is in one field it'll be difficult to perform meaningful analysis in Kibana. Kibana doesn't have a way to convert this data, although you may be to search over it. Before ingesting into elasticsearch I would recommend breaking the data up into individual fields using something like logstash.
---
### Author:  [@sabyasachi\_mallick](https://discuss.elastic.co/u/sabyasachi_mallick)
#### Post date: [September 20, 2016, 9:09am UTC](https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866/3 "2016-09-20T09:09:39Z")
yea i am using logstash. i am also indexing the whole data. My problem is i want to fetch a portion of indexed field.
like i want to replicate the function of re.group(0) of python regular expression. i want the count of that part , which i don't what ll appear in that position.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:38pm UTC](https://discuss.elastic.co/t/extracting-a-portion-of-a-field-in-kibana/60866/4 "2017-07-06T13:38:41Z")