# Include/ Exclude pattern

**URL:** <https://discuss.elastic.co/t/include-exclude-pattern/1902>\
**Category:** Kibana\
**Created:** [June 4, 2015, 7:00am UTC](https://discuss.elastic.co/t/include-exclude-pattern/1902 "2015-06-04T07:00:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\
**Post date:** [June 4, 2015, 7:00am UTC](https://discuss.elastic.co/t/include-exclude-pattern/1902/1 "2015-06-04T07:00:57Z")

</div>

I have one field whose values are in following format "application/x-javascript", "text/html", "text/css".  
When plotting at kibana graph its splitting as follows "application", "x" and "javascript".

I would like to view in first application, text. and when i click on application to further drill down i should be able to see...  
x-javascript, x-shockwave etc.

Is there any way to achieve this?

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [June 17, 2015, 5:19am UTC](https://discuss.elastic.co/t/include-exclude-pattern/1902/2 "2015-06-17T05:19:19Z")

</div>

You should pre-parse the field in question to split values on the slash and store the additional fields in Elasticsearch prior to operating on them in Kibana.

Alternatively, you could turn on static Groovy scripts in Elasticsearch and use Kibana Scripted Fields to create these values (more on that in [this thread](https://discuss.elastic.co/t/calling-groovy-script-from-kibana/2542)), but that can be quite cumbersome.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:18pm UTC](https://discuss.elastic.co/t/include-exclude-pattern/1902/3 "2017-07-06T14:18:00Z")

</div>


