# How can I split the value of field to “xxxxx” and then aggregate for this "xxxxx" **URL:** \ **Category:** Elasticsearch\ **Created:** [April 19, 2019, 5:46am UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567 "2019-04-19T05:46:41Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jaxma](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jaxma](https://discuss.elastic.co/u/jaxma)\ **Post date:** [April 19, 2019, 5:46am UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/1 "2019-04-19T05:46:41Z")
Here is a demo : **message:** send alarm success, code:195, content:{"code":195,"ip":"172.16.92.22","desc":"[dmp-custom-api] reqId: [2073d1ef3971ef2e] 查询async-hbase异常 table: fraud:general\_feature\_m\_v2, rowKey: 861189030090467, cost: 3001 msg: Timed out after 3000ms when joining Deferred@718887266(state=PENDING, result=null, callback=type get response -\> cn.jiguang.data.common.HbaseHelper$$Lambda$35/479850351@43b2d9e6 -\> passthrough -\> wakeup thread http-nio-11003-exec-5, errback=passthrough -\> passthrough -\> How can I split the value to "查询async-hbase异常 table: fraud:general\_feature\_m\_v2" ,and aggregate for this . I need to get the number of that. ---
**Author:** ![gabriel\_tessier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel_tessier/32/27911_2.png) [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Post date:** [April 20, 2019, 3:55am UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/2 "2019-04-20T03:55:21Z")
Hi, Your need is to count how much documents have the string 查询async-hbase异常 table: fraud:general\_feature\_m\_v2, inside? If so can you consider indexing your data using a whitespace tokenizer with multi fields. more details in the doc: [https://www.elastic.co/guide/en/elasticsearch/reference/7.0/analysis-whitespace-tokenizer.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/analysis-whitespace-tokenizer.html) and about search [https://www.elastic.co/guide/en/elasticsearch/reference/7.0/analyzer.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/analyzer.html) and multi fields [https://www.elastic.co/guide/en/elasticsearch/reference/7.0/multi-fields.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/multi-fields.html) so you will have this 3 tokens: 1- 查询async-hbase异常 2- table: 3- fraud:general\_feature\_m\_v2, Then you can make a default count with a query string. Maybe this way is more simple for that. 😀 ---
**Author:** ![jaxma](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jaxma](https://discuss.elastic.co/u/jaxma)\ **Post date:** [April 20, 2019, 3:22pm UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/3 "2019-04-20T15:22:39Z")
thanks for your help!!!!! I will try that ! 😁 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 20, 2019, 9:37pm UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/4 "2019-04-20T21:37:22Z")
You other option would be to use the ingest API and split the message apart. ---
**Author:** ![gabriel\_tessier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel_tessier/32/27911_2.png) [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Post date:** [April 21, 2019, 2:31am UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/5 "2019-04-21T02:31:46Z")
Hi, As @warkolm said you can use ingest API or logstash. If you give more information about the structure of your document as I understand in your first question you have a "message" field that have a string separated with "," and containing something like a json dict but your search is about a substring from value contained in the message field. Is it correct? Also need to consider depends on the srtucture of your document that you will not be able to parse if it's not enough normalized. You will have too much fields. You can read about here: > **[Troubleshooting Elasticsearch searches, for Beginners | Elastic](https://www.elastic.co/blog/found-beginner-troubleshooting#keyvalue-woes)** > > We'll look at common problems when getting started with Elasticsearch. ---
**Author:** ![jaxma](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jaxma](https://discuss.elastic.co/u/jaxma)\ **Post date:** [April 21, 2019, 3:13pm UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/6 "2019-04-21T15:13:18Z")
After reding the doc in your suggestion. I still have a little doubt .so let describe in more details My messge field represent my log information in my application like LOGGER.info(message) and also have been index into my elasticSearch (changing the index mode is not the first choose 😂), so it dont have a nomalized structure. Now I want to know if I can aggregate message field only contain “查询async-hbase异常 table”. My expect result will be like this: [{"key":"查询async-hbase异常 table:xx", "docCount":55}, {"key"："查询async-hbase异常 table:yy", "docCount":99}] ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 19, 2019, 3:13pm UTC](https://discuss.elastic.co/t/how-can-i-split-the-value-of-field-to-xxxxx-and-then-aggregate-for-this-xxxxx/177567/7 "2019-05-19T15:13:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.