# How to create an histogram of substring occurences?

**URL:** <https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942>\
**Category:** Kibana\
**Created:** [August 6, 2019, 6:58am UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942 "2019-08-06T06:58:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![s7ygian](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@s7ygian](https://discuss.elastic.co/u/s7ygian)\
**Post date:** [August 6, 2019, 6:58am UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/1 "2019-08-06T06:58:27Z")

</div>

Hi,

I have the following 3 exemplary JSON log entries:

```
{
  hint_lists: [{
      "hint_list": ["Entity X with number 1 is unknown!", "Entity Y with number 2 is unknown!", "Entity Z with number 3 unkown!"]
    }, {
      "hint_list": ["Entity X with number 1 is unknown!", "Entity Y with number 2 is unknown!", "Entity Z with number 3 unkown!"]
    }
  ]
}

{
  hint_lists: [{
      "hint_list": ["Entity X with number 1 is unknown!", "Entity Y with number 2 is unknown!"]
    }, {
      "hint_list": ["Entity X with number 1 is unknown!", "Entity Y with number 2 is unknown!"]
    }
  ]
}

{
  hint_lists: [{
      "hint_list": ["Entity X with number 1 is unknown!"]
    }, {
      "hint_list": ["Entity X with number 1 is unknown!"]
    }
  ]
}

```

Now I want to create a histogram (unknown entity number -\> count) in Kibana with the following result:

1: 6  
2: 4  
3: 2

How can I achieve that within Logstash and/or Kibana?

Best regards, s7ygian

---

<div class="post-metadata">

**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\
**Post date:** [August 6, 2019, 4:26pm UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/2 "2019-08-06T16:26:15Z")

</div>

I'm not entirely sure I follow, but if you're trying to extract the numeric value from your text fields, then run a histogram on that, it's going to be tricky. The easiest thing is to write the numbers as separate fields when the data is written. If you can't do that, you _may_ be able to do something with scripted fields to do the extraction and then crunch some stats on that, but I'm not sure.

---

<div class="post-metadata">

**Author:** ![s7ygian](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@s7ygian](https://discuss.elastic.co/u/s7ygian)\
**Post date:** [August 7, 2019, 6:29am UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/3 "2019-08-07T06:29:51Z")

</div>

I also thought about extracting the count of every unknown entity into individual fields (e.g. unknown\_1, unknown\_2, unknown\_3) per log entry. But how can I create the histogram mentioned above in Kibana out of these fields in the next step?

Note: The above log entries are only examples. There are about 100K entities with different entity numbers, all of which may be unknown once or several times in one or multiple log entries.

---

<div class="post-metadata">

**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\
**Post date:** [August 7, 2019, 3:06pm UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/4 "2019-08-07T15:06:34Z")

</div>

Maybe I'm misunderstanding what you're trying to do, but it sounds like a terms aggregation should get you the data you want.

---

<div class="post-metadata">

**Author:** ![s7ygian](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@s7ygian](https://discuss.elastic.co/u/s7ygian)\
**Post date:** [August 21, 2019, 1:15pm UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/5 "2019-08-21T13:15:29Z")

</div>

Could you explain that in more detail, please?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2019, 1:23pm UTC](https://discuss.elastic.co/t/how-to-create-an-histogram-of-substring-occurences/193942/6 "2019-09-18T13:23:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.