# Grouping values?

**URL:** https://discuss.elastic.co/t/grouping-values/117001
**Category:** Kibana
**Created:** [January 25, 2018, 8:44am UTC](https://discuss.elastic.co/t/grouping-values/117001 "2018-01-25T08:44:46Z")
**Posts on this page:** 1
**Showing post:** 13

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [February 14, 2018, 5:25am UTC](https://discuss.elastic.co/t/grouping-values/117001/13 "2018-02-14T05:25:34Z")

</div>

> [@LeeDr](#):
>
> if ( (doc['dst\_host'].value.indexOf('facebook') \> 0 ) || (doc['dst\_host'].value.indexOf('fb') \> 0) )

Hi LeeDr,

Thanks for all the help, really appreciate all the effort you are putting in.

The field created by my mapping is only searchable but the .keyword field is searchable and aggregatable.  
If I use your script with replaced field names Kibana trows this error.

> [@](#):
>
> Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"script\_exception","reason":"compile error","script\_stack":["... alue.indexOf('fb') \> 0) )"," ^---- HERE"],"script":"if ( (doc['dst\_addr\_host.keyword'].value.indexOf('facebook') \> 0 ) || (doc['dst\_addr\_host.keyword'].value.indexOf('fb') \> 0) )","lang":"painless"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"logstash-netflow-test-2018.06","node":"1SzZYb8ZQ2iyTAlNHwe9jA","reason":{"type":"script\_exception","reason":"compile error","script\_stack":["... alue.indexOf('fb') \> 0) )"," ^---- HERE"],"script":"if ( (doc['dst\_addr\_host.keyword'].value.indexOf('facebook') \> 0 ) || (doc['dst\_addr\_host.keyword'].value.indexOf('fb') \> 0) )","lang":"painless","caused\_by":{"type":"illegal\_argument\_exception","reason":"unexpected end of script.","caused\_by":{"type":"no\_viable\_alt\_exception","reason":null}}}}]},"status":500}

---

_[View the full topic](https://discuss.elastic.co/t/grouping-values/117001)._