Kibana keyword aggregation for visualisation


I am struggeling with a little aggregation task. Let's say we have to following data from winlogbeat:
First data:

"param1":  ""

Second data:

"param1": ""

If I perform a pie chart with count it will tell me and separately. How am I able to perform a count on everything before the :. I do not care about the ports.

I am not able to rework the pipeline or todo something inside winlogbeat. Therefore, I have to solve this issue inside kibana.

Any idea?

Hey @philippkahr, you can do this using a Kibana Scripted Field similar to the following, however, it will much more performant to do so on ingest.

Painless Script:

String val = doc['param1'].value;
int index = val.indexOf(':');
return val.substring(0, index);

Thanks very much for your help. I totally forgot about scripted fields! Works as expected

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.