# Kibana keyword aggregation for visualisation

**URL:** <https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599>\
**Category:** Kibana\
**Created:** [September 16, 2019, 8:02am UTC](https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599 "2019-09-16T08:02:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [September 16, 2019, 8:02am UTC](https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599/1 "2019-09-16T08:02:51Z")

</div>

Hi,

I am struggeling with a little aggregation task. Let's say we have to following data from winlogbeat:  
First data:

```json
{
"param1": "1.2.3.4:5555"
}

```

Second data:

```json
{
"param1": "1.2.3.4:6666"
}

```

If I perform a pie chart with count it will tell me `1.2.3.4:6666` and `1.2.3.4:5555` separately. How am I able to perform a count on everything before the `:`. I do not care about the ports.

I am not able to rework the pipeline or todo something inside winlogbeat. Therefore, I have to solve this issue inside kibana.

Any idea?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [September 16, 2019, 4:50pm UTC](https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599/2 "2019-09-16T16:50:55Z")

</div>

Hey @philippkahr, you can do this using a [Kibana Scripted Field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) similar to the following, however, it will much more performant to do so on ingest.

Painless Script:

```auto
String val = doc['param1'].value;
int index = val.indexOf(':');
return val.substring(0, index);

```

 ![42%20AM](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b44bf3bbe790636a0e745fad055443895fb098a8.png)

---

<div class="post-metadata">

**Author:** ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)\
**Post date:** [September 17, 2019, 5:50am UTC](https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599/3 "2019-09-17T05:50:04Z")

</div>

> [@Brandon\_Kobel](#):
>
> String val = doc['param1'].value; int index = val.indexOf(':'); return val.substring(0, index);

Thanks very much for your help. I totally forgot about scripted fields! Works as expected

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2019, 5:50am UTC](https://discuss.elastic.co/t/kibana-keyword-aggregation-for-visualisation/199599/4 "2019-10-15T05:50:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.