# How to extract a field from message and create a visualization?

**URL:** <https://discuss.elastic.co/t/how-to-extract-a-field-from-message-and-create-a-visualization/164559>\
**Category:** Kibana\
**Created:** [January 17, 2019, 1:22am UTC](https://discuss.elastic.co/t/how-to-extract-a-field-from-message-and-create-a-visualization/164559 "2019-01-17T01:22:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![friscos](https://avatars.discourse-cdn.com/v4/letter/f/9e8a1a/32.png) [@friscos](https://discuss.elastic.co/u/friscos)\
**Post date:** [January 17, 2019, 1:22am UTC](https://discuss.elastic.co/t/how-to-extract-a-field-from-message-and-create-a-visualization/164559/1 "2019-01-17T01:22:58Z")

</div>

Hi,

I would like to extract a responsetime from message and create a visualization for the response time. How do i do that?

Here is how my message looks like:

{  
"\_index": "test",  
"\_type": "logs",  
"\_id": "pTylV93",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"application-name": "test",  
"@timestamp": "2019-01-17T01:10:55.297Z",  
"level": "INFO",  
"logger": null,  
"@version": "1",  
"message": "{ "Service":"ABC", "abcresponsetime":158,"Service":"XYZ","xyzresponsetime":340}",  
"loggerName": "test",  
"timestamp": "2019-01-17T01:10:54.842+00:00",  
"unknownFields": {  
"loggerName": "test"  
}  
},  
"fields": {  
"@timestamp": [  
1547687455297  
],  
"timestamp": [  
1547687454842  
]  
},  
"sort": [  
1547687454842  
]  
}

I am interested in creating the visualization for xyzresponsetime. Please advise.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 17, 2019, 6:26am UTC](https://discuss.elastic.co/t/how-to-extract-a-field-from-message-and-create-a-visualization/164559/2 "2019-01-17T06:26:06Z")

</div>

This is something you should do before indexing your data into Elasticsearch, e.g. using Logstash or an ingest node pipeline. Trying to parse this out at query time will be expensive, slow and most likely not scale well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2019, 6:26am UTC](https://discuss.elastic.co/t/how-to-extract-a-field-from-message-and-create-a-visualization/164559/3 "2019-02-14T06:26:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.