# Kibana lens grouping data by string pattern

**URL:** <https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125>\
**Category:** Kibana\
**Tags:** lens\
**Created:** [January 12, 2022, 8:42am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125 "2022-01-12T08:42:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Realsnack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/realsnack/32/100184_2.png) [@Realsnack](https://discuss.elastic.co/u/Realsnack)\
**Post date:** [January 12, 2022, 8:42am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125/1 "2022-01-12T08:42:12Z")

</div>

Hello,

we have some finance transactions saved in Elasticsearch and I would like to create a visualization on the data.

All of the records have field "messageType" with a string value and I would need to group the records inside the chart by the value from this field when the have the same prefix.

The values are like "HD00, HD11, MT103, MT203". And on the chart i would like the see that I have X records of HD type and Y records of MT type.

Is that possible?

Kibana version is 7.12.1

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [January 12, 2022, 8:45am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125/2 "2022-01-12T08:45:17Z")

</div>

You can use a runtime field for that: [Manage index pattern data fields | Kibana Guide [7.16] | Elastic](https://www.elastic.co/guide/en/kibana/current/managing-index-patterns.html)

Use a painless script to extract the prefix from the message type into a separate field, then use this field in the visualization.

Let me know if you need help with extracting the prefix

---

<div class="post-metadata">

**Author:** ![Realsnack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/realsnack/32/100184_2.png) [@Realsnack](https://discuss.elastic.co/u/Realsnack)\
**Post date:** [January 17, 2022, 6:02am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125/3 "2022-01-17T06:02:59Z")

</div>

Thank you very much for nudging me in the right direction.  
I didn't have the option to create a runtime field, so i created a scripted field and it works perfectly

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2022, 6:03am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125/4 "2022-02-14T06:03:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.