# How to group similar messages on a chart

**URL:** https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080
**Category:** Kibana
**Created:** [November 1, 2018, 8:48pm UTC](https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080 "2018-11-01T20:48:58Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![gnumoksha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gnumoksha/32/37220_2.png) [@gnumoksha](https://discuss.elastic.co/u/gnumoksha)
#### Post date: [November 1, 2018, 8:48pm UTC](https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080/1 "2018-11-01T20:48:58Z")

</div>

Hi. We are sending our application logs directly to elasticsearch and visualizing them in some graphs. But some log messages are about the same thing, just some parts are different. So we need to group this messages by the file and line from where they were sent. Assuming all the fields are properly sent to the elasticsearch, how can we do this grouping?

This question is the same as in [Kibana Terms panel: How to group similar values](https://discuss.elastic.co/t/kibana-terms-panel-how-to-group-similar-values/20382)

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [November 2, 2018, 4:11am UTC](https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080/2 "2018-11-02T04:11:51Z")

</div>

I believe a filters aggregation with a regexp filter will get you what you are looking for:  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html)

[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html) (even though examples here show use in query, this should also work in a filter context)

I tried this on my end- may be it can help you- I have filebeat data which has some messages that include words like `disconnecting` and `disconnected` and maybe some other variations.  
So I created a new horizontal bar graph visualization and selected the `Filters` aggregation.  
Then I created several filters. Each filter is a query and you can use wildcards, AND OR, etc.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60657ce0acc0b2efd78890358ce2f1a419abe1ab.png)

Hope this helps  
Rashmi

---

<div class="post-metadata">

### Author: ![gnumoksha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gnumoksha/32/37220_2.png) [@gnumoksha](https://discuss.elastic.co/u/gnumoksha)
#### Post date: [November 5, 2018, 12:28pm UTC](https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080/3 "2018-11-05T12:28:45Z")

</div>

Hi, thank you for the reply. I've stumbled upon this feature but I cannot anticipate which messages I will get. I need to group the messages by some other field or group of fields, like the field which stores the file and line from where the message came from.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2018, 12:28pm UTC](https://discuss.elastic.co/t/how-to-group-similar-messages-on-a-chart/155080/4 "2018-12-03T12:28:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
