# How to create aggregated field and further kibana dashboard **URL:** \ **Category:** Kibana\ **Created:** [August 30, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-create-aggregated-field-and-further-kibana-dashboard/197534 "2019-08-30T14:15:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![O\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/o_k/32/52424_2.png) [@O\_K](https://discuss.elastic.co/u/O_K)\ **Post date:** [August 30, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-create-aggregated-field-and-further-kibana-dashboard/197534/1 "2019-08-30T14:15:41Z")
Hello, I created several filters in fluentd like below and have separate fields in Kibana as well: **nginx\_timestamp, DATA:nginx\_log\_level, nginx\_message** Question: what is need to have aggregated field created **nginx\_log\_level.keyword** and further dashboard to be built? I understand some mapping should be amendment, appreciate if you provide step-by-step guidance regarding this. @type parser key\_name log reserve\_data true reserve\_time true @type grok grok\_failure\_key grokfailure pattern %{TIMESTAMP\_ISO8601:nginx\_timestamp}" %{DATA:nginx\_log\_level} %{GREEDYDATA:nginx\_message} ---
**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\ **Post date:** [August 30, 2019, 7:03pm UTC](https://discuss.elastic.co/t/how-to-create-aggregated-field-and-further-kibana-dashboard/197534/2 "2019-08-30T19:03:17Z")
Hi @O_K, If you are looking to visualize aggregated data for `nginx_log_level.keyword`, there are a couple of things you'll want to do: - Make sure you are sending the data from Fluentd to Elasticsearch with the correct `nginx_log_level` field name. Fluentd has [an Elasticsearch output plugin](https://docs.fluentd.org/output/elasticsearch) you could use for this if you haven't found a solution already. - Update your ES mappings using the [Mapping API](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html). You'll probably want to either map `nginx_log_level` as `keyword` [as shown here](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html#keyword), or if you also need to perform full-text search, use multi-fields to map as both `text` and `keyword` [as shown here](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html#multi-fields). - Refresh your [Index Pattern](https://www.elastic.co/guide/en/kibana/current/tutorial-define-index.html) in Kibana (or create a new one if you haven't yet), and confirm the field is mapped as you expect. - Then you can [create a new visualization](https://www.elastic.co/guide/en/kibana/current/createvis.html) with a `terms` [aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/search-aggregations.html) on the `nginx_log_level`. This visualization can be saved and [added to any dashboard](https://www.elastic.co/guide/en/kibana/current/dashboard-create-new-dashboard.html). You could also apply filters to the dashboard itself to view data across all visualizations that's related to a particular log level. The Kibana docs have a [Build Your Own Dashboard](https://www.elastic.co/guide/en/kibana/current/tutorial-build-dashboard.html) tutorial which you may find helpful. It shows you how all of this looks end-to-end. Hopefully this helps answer your question, but feel free to reach out if you need help with anything more specific! Cheers Luke ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2019, 7:03pm UTC](https://discuss.elastic.co/t/how-to-create-aggregated-field-and-further-kibana-dashboard/197534/3 "2019-09-27T19:03:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.