# Grouping legend entries

**URL:** <https://discuss.elastic.co/t/grouping-legend-entries/301058>\
**Category:** Kibana\
**Created:** [March 30, 2022, 8:54am UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058 "2022-03-30T08:54:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marjolein](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Marjolein](https://discuss.elastic.co/u/Marjolein)\
**Post date:** [March 30, 2022, 8:54am UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058/1 "2022-03-30T08:54:05Z")

</div>

Hi!

I'm currently making my first Kibana dashboards and I'm running into an issue. I want to make a Pie chart of values with tags that look like this:  
Node1-1  
Node1-2  
Node1-3  
Node2-1  
Node2-2  
Node2-3  
etc

I want the values of all the Node1-\* to group together and be visible as 'Node1' in the legend. I can't find how to do this, is this possible?

This is my first question, so apologies if it is not in the right space.

Thanks!

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [March 30, 2022, 10:41am UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058/2 "2022-03-30T10:41:23Z")

</div>

That's not possible with a single field, but you could split it up into two fields - these would be your documents:

```auto
{ node: "Node1" subNode: "1" }
{ node: "Node1" subNode: "2" }
{ node: "Node1" subNode: "3" }
{ node: "Node2" subNode: "1" }
{ node: "Node2" subNode: "2" }
...

```

Then you can do a two-layer pie chart which is behaving that way already by default:

 ![Screenshot 2022-03-30 at 12.39.28](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a785eeb0a16ffd205ca12c2ab0acfce3e7f5c70c.jpeg)

You don't have to re-index your data to do this, you can create a runtime field for it: [Manage data views | Kibana Guide [8.1] | Elastic](https://www.elastic.co/guide/en/kibana/8.1/managing-data-views.html#create-runtime-fields)

---

<div class="post-metadata">

**Author:** ![Marjolein](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Marjolein](https://discuss.elastic.co/u/Marjolein)\
**Post date:** [March 30, 2022, 3:06pm UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058/3 "2022-03-30T15:06:33Z")

</div>

Hi!

Thanks for your reply. Unfortunately there is no way for me to split the names in different parts. Or do you mean that this is something Kibana can do?

I'm sorry, I'm really a beginner.

Best for me would be to be able to group using a wildcard, like "group by Node1\*". I take it this is not possible?

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [March 30, 2022, 3:08pm UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058/4 "2022-03-30T15:08:05Z")

</div>

That's the runtime field part - [Manage data views | Kibana Guide [8.1] | Elastic](https://www.elastic.co/guide/en/kibana/8.1/managing-data-views.html#create-runtime-fields)

You can provide a painless script which is splitting the single field into two in the way to want (painless is a dialect of Java).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2022, 3:08pm UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058/5 "2022-04-27T15:08:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.