# HELP: Grouping and combine fields

**URL:** <https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129>\
**Category:** Kibana\
**Created:** [March 4, 2020, 5:11pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129 "2020-03-04T17:11:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 4, 2020, 5:11pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/1 "2020-03-04T17:11:21Z")

</div>

Hi All,

I am bit new to kibana.  
Till now using fields i was able to bulid my visualization and dashboard. But now my requirement is to group fields and show it in PIE chart which i feel it needs some advance query knowledge, which i have never done.

My requirement is like below: I have multiple entries like below  
ABC-11-2019  
ABC-12-2019  
ABC-01-2020  
XYZ-11-2019  
XYZ-12-2019  
XYZ-01-2020  
QWE-11-2019  
QWE-12-2019  
QWE-01-2020

It has entries which ends with month and year.

In my pie chart I need to show only 3 slices ABC, XYZ and QWE, however when i try to do it shows 9 slices.

Can someone point me to the right direction, how I can write query to build right visualization as per the requirement.

Appreciate all your help.

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [March 4, 2020, 9:04pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/2 "2020-03-04T21:04:38Z")

</div>

@bharatchhajed The reason why it is showing 9 is because when you do a terms aggregation (for piechart) , each of these entries are unique terms (ABC-11-2019 for e.g. is not the same as ABC-01-2019). So the total unique terms turns out to be 9 and not 3.

If you are using Logstash to ingest your logs, you could parse that field with something like below (if ABC or XYZ is always going to be in the beginning)

```
ruby {
    code => "event.set('prefix', event.get('value').split('-').first)"
  }

```

and then use the newly created 'prefix' field in your logs for doing a terms aggregation on it. If you already have ingested logs in your Elasticsearch, you will have to reindex logs while running it through that parser code.

---

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 5, 2020, 5:49am UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/3 "2020-03-05T05:49:25Z")

</div>

Thanks Rahul for your reply. We are not using Logstash, we are injecting logs to ES directly from our application.  
Is there a way to handle from Kibana side by writing query or something.

I tried doing **{"script":"doc['\_index'].value.substring(0,2)"}** its not working all the time as someof the fields have more then 3 charecters. Is there a way where I can do a split or some string manipulation where i can split with -.  
I also tried **{"script":"doc['\_index'].value.split('-').first"}** --\> This has not worked

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [March 7, 2020, 8:32pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/4 "2020-03-07T20:32:23Z")

</div>

@bharatchhajed You can try to create a Kibana scripted field with the script below

```
if (doc['value.keyword'].size() == 0) {
    return 'NA'; 
}else {
    String str = doc['value.keyword'].value;
    String id =str.substring(0,str.indexOf("-")); 
    return id; 
}

```

You can change `NA` to whatever you want. This can serve as a bucket for those docs that don't have that field if you want analyze them in your pie chart.

Please change the field name from `value` to whatever your field name is. When creating the scripted field in Kibana, choose the type of field to be `String`

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [March 7, 2020, 8:35pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/5 "2020-03-07T20:35:10Z")

</div>

@bharatchhajed This approach works when I try in my ES/Kibana

 ![Screen Shot 2020-03-07 at 3.32.14 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79b0ae8dd3ee2881cc6a8a392f6d3a5d8c292b04.png)

---

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 9, 2020, 12:37pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/6 "2020-03-09T12:37:52Z")

</div>

Thanks a lot Rahul.. It works for me as well..  
Cheers!

---

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 10, 2020, 10:25am UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/7 "2020-03-10T10:25:47Z")

</div>

Hi Rahul,  
Can you please point out which language does it support? I tried couple of ways but was unable to do it. Does it support split and arrays as well?  
Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [March 10, 2020, 2:19pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/8 "2020-03-10T14:19:18Z")

</div>

`Painless` is the language you are looking for and below are some useful guides.

[https://www.elastic.co/guide/en/kibana/current/scripted-fields.html](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)

> **[Using Painless in Kibana scripted fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)**
>
> This blog presents common use cases for Kibana scripted fields, and walks user through how to create scripted fields in a newly set-up Elastic Cloud instance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2020, 2:19pm UTC](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/9 "2020-04-07T14:19:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.