# Kibana Keyword compare and collate based on the unique query list in string format

**URL:** <https://discuss.elastic.co/t/kibana-keyword-compare-and-collate-based-on-the-unique-query-list-in-string-format/254039>\
**Category:** Kibana\
**Created:** [November 2, 2020, 2:08pm UTC](https://discuss.elastic.co/t/kibana-keyword-compare-and-collate-based-on-the-unique-query-list-in-string-format/254039 "2020-11-02T14:08:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kannan\_Rajendran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kannan_rajendran/32/78272_2.png) [@Kannan\_Rajendran](https://discuss.elastic.co/u/Kannan_Rajendran)\
**Post date:** [November 2, 2020, 2:08pm UTC](https://discuss.elastic.co/t/kibana-keyword-compare-and-collate-based-on-the-unique-query-list-in-string-format/254039/1 "2020-11-02T14:08:47Z")

</div>

i have a scenario of collating some list of repeated SQL slow query with date vise transaction. My aim is to achieve unique no of the repeated SLOW query list which occurs in the certain time period in a data table visualization (Group them).

When i add this Query in the Term aggregation with keyword parameter there is no result displayed in the data table.

These are some sample query i want to group,

 ![slow query](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4bbfb02d88980818e0fe463b39b8bb985cb8d90.png)

Any idea if there any custom KQL query can do this job? ![term agg](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1dd0d00d43144d8f3466ff250a2a85be8367e3e.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [November 2, 2020, 3:08pm UTC](https://discuss.elastic.co/t/kibana-keyword-compare-and-collate-based-on-the-unique-query-list-in-string-format/254039/2 "2020-11-02T15:08:24Z")

</div>

Seems like a scripted field can help with that: [https://www.elastic.co/guide/en/kibana/current/scripted-fields.html](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)

The script should pull the information relevant to you out of the message field, then you can use terms on top of it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2020, 3:08pm UTC](https://discuss.elastic.co/t/kibana-keyword-compare-and-collate-based-on-the-unique-query-list-in-string-format/254039/3 "2020-11-30T15:08:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.