# Finding most severe code from a set of "error, warning and success" **URL:** \ **Category:** Kibana\ **Created:** [May 4, 2016, 8:37am UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137 "2016-05-04T08:37:57Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [May 4, 2016, 8:37am UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137/1 "2016-05-04T08:37:57Z")
I have a log that looks like this: `RequestID=request1 ComponentID=component1 Result=success RequestID=request2 ComponentID=component2 Result=warning RequestID=request1 ComponentID=component1 Result=success RequestID=request2 ComponentID=component2 Result=error RequestID=request2 ComponentID=component3 Result=success RequestID=request1 ComponentID=component1 Result=success` I am bringing the log in through Logstash. I am `kv`-ing the various fields, and I also add a _numeric_ field called `error_code` depending on the `Result` (for success, error\_code is 0, warning is 1, error is 2). I add this field so I can run a max aggregation (see below). I have created a visualization in Kibana, a table, which uses the following: - Rows split by terms aggregation on `RequestID`, so I get one row per request. - The metric `max of error_code` on each row, so I get the overall "worst" result for each request. This is functionally what I want, however I would like to have, for each row, the string `Result` (so Success, Error or Warning) instead of the numeric `error_code`. How can I do this? Thanks for the help. Dan ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 5, 2016, 3:25am UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137/2 "2016-05-05T03:25:08Z")
No sure there is a way to do this, even with field formatters. Maybe one of the KB team has a better idea though. ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [May 5, 2016, 11:37pm UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137/3 "2016-05-05T23:37:34Z")
You could use a **custom** field formatter to translate your `max error_code` back into the message text, or you could use the data table instead, and do something like: - split rows: - agg: terms - field: error\_code - orderby max error\_code decending - size: 1 - split rows again: - agg: terms - field: Result This should show you a column for the error\_code, and then a column for the corresponding Result ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [May 13, 2016, 7:56am UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137/4 "2016-05-13T07:56:01Z")
Hi Spencer, and thanks! I managed to solve the problem by slightly modifying what you suggested: - split rows: - field: Result - orderby max error\_code descending - size: 1 This shows me just the column for the Result, which is exactly what I needed. Again, many thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/finding-most-severe-code-from-a-set-of-error-warning-and-success/49137/5 "2017-07-06T13:53:27Z")
Closed on July 6, 2017, 1:53pm UTC