# Kibana dashboard visualize query

**URL:** <https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074>\
**Category:** Kibana\
**Created:** [January 28, 2017, 12:17am UTC](https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074 "2017-01-28T00:17:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ViJaY\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijay_s/32/42280_2.png) [@ViJaY\_S](https://discuss.elastic.co/u/ViJaY_S)\
**Post date:** [January 28, 2017, 12:17am UTC](https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074/1 "2017-01-28T00:17:45Z")

</div>

Hello,

Could you please help me out to create Visualize in Kibana dashboard for the PDF Downloaded Counts from IIS Logs.

Using Status code of 200 and only .PDF downloaded counts should display using filters.

For Example:

Status : 200 AND (URI ; (\*.pdf))

Iam trying the above query in filters its not showing up right counts sometimes Gateway Timed out Error.

This Works well in Log Parser Query feed:

"SELECT c-ip As Machine, COUNT(\*) As Hits, cs-uri-stem FROM \*.log where cs-uri-stem like '%.pdf' GROUP BY Machine,cs-uri-stem ORDER BY Hits DESC"

I want same results in kibana dashboard.

Please help me out to fix.

Thanks,

VJ

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [January 30, 2017, 9:49pm UTC](https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074/2 "2017-01-30T21:49:25Z")

</div>

hi @ViJaY_S,

That's for a filter in the Filter-bar in Kibana?

You can't do a wildcard search at the beginning of the string when doing Lucene queries ([https://lucene.apache.org/core/2\_9\_4/queryparsersyntax.html#Wildcard](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html#Wildcard) Searches).

For this type of functionality, people generally parse out the file-extension first into a separate field before indexing it in ES.

If that is not feasible, you could create a scripted field in Kibana ([https://www.elastic.co/guide/en/kibana/current/scripted-fields.html](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)) that parses out the file extension for you.

Note that search using the first approach will be a lot faster than with the 2nd approach.

---

<div class="post-metadata">

**Author:** ![ViJaY\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijay_s/32/42280_2.png) [@ViJaY\_S](https://discuss.elastic.co/u/ViJaY_S)\
**Post date:** [January 31, 2017, 12:49am UTC](https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074/3 "2017-01-31T00:49:09Z")

</div>

Yes its Filter in kibana search bar.

**Status : 200 AND (URI ; (\*.pdf))**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2017, 12:49am UTC](https://discuss.elastic.co/t/kibana-dashboard-visualize-query/73074/4 "2017-02-28T00:49:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.