# How to get the counts of log messages based on the error type in Elasticsearch visualization
**URL:** https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213
**Category:** Kibana
**Created:** [March 7, 2019, 12:37am UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213 "2019-03-07T00:37:05Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 7, 2019, 12:37am UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/1 "2019-03-07T00:37:05Z")
I have some sample data on the Elasticsearch, which looks like the following:
I am using the data table in the Visualize section to get the counts for each error type, for example: it should output
`Error: Update failed for online booking with id`, count is 5.
Not the count 1 for different id of the same error type.
What I have done is to build a query to output the counts for each error type, which looks like this:
However, when I save the query as the saved search, then visualize it as data table, it still have the same issue as above.
I was thinking to only save the output of that query as saved search, one issue is that the output is too verbose, has a lot of information I don't really need.
Any suggestions please !
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [March 7, 2019, 2:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/2 "2019-03-07T14:19:37Z")
could you show a sample of your document ?
---
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 7, 2019, 9:37pm UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/3 "2019-03-07T21:37:38Z")
I am sorry that I cannot show some sample. my concern is that I can create a query to get the counts for each error message using regex, however, in terms of visualization, we have no way to get the same result.
---
### Author:  [@Babadofar](https://discuss.elastic.co/u/Babadofar)
#### Post date: [March 8, 2019, 8:24pm UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/4 "2019-03-08T20:24:41Z")
You should preprocessor your documents, logstash can do some for you, like remove numbers from Messages etc. Also, create visualisation in kibana, first, it will generate query
---
### Author:  [@vampire](https://discuss.elastic.co/u/vampire)
#### Post date: [March 8, 2019, 10:31pm UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/5 "2019-03-08T22:31:17Z")
Thanks for the reply, Christoffer. However, the real data is much more complicated than this. so simply remove the number is not gonna work. I am thinking about using the scripted fields. do you have any suggestion doing that?
---
### Author:  [@Babadofar](https://discuss.elastic.co/u/Babadofar)
#### Post date: [March 9, 2019, 7:58am UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/6 "2019-03-09T07:58:47Z")
My suggestion is to pre process data, before it reaches elasticsearch. Kibana scripted fields are applied on the fly when executing query, and is not very powerful. Look into logstash filters. [https://www.elastic.co/guide/en/logstash/current/filter-plugins.html](https://www.elastic.co/guide/en/logstash/current/filter-plugins.html) and elasticsearch analysers [https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis.htm](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis.htm)
If logstash does not have the filter you need, then you can create a custom application to transform your data.
Analysers are a key ingredient in making complex data searchable, which you need to use even if Logstash doesn't cut the mustard.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2019, 7:58am UTC](https://discuss.elastic.co/t/how-to-get-the-counts-of-log-messages-based-on-the-error-type-in-elasticsearch-visualization/171213/7 "2019-04-06T07:58:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.