Kibana need to combine results or change filter

Elastic Stack Kibana
1

I have created a grok filter that is correctly labeling the fields in Kibana, but now I want to see if I can make a filter or do something within side Kibana to meet my needs.

I have a data table visualization created that has the name of student applications example below:

edu.utah.acs.student.coupledapps.commonejb.lib.ACSHandler 2,323
edu.utah.acs.student.coupledapps.studentfinance.ejb.StudentFinanceServicesBean 268
edu.utah.acs.student.coupledapps.commonejb.util.student.ClassDataPopulator 88

Problem: I want to combine these results. Everything that has "edu.utah.acs.student.coupledapps" I want to combine the count for. "coupledapps" is the app name and everything after belongs to the same app so I want it represented count wise as the same app.

Best,
Monty

2

Depending on how many unique application names you have, you might be able to use the "Filters" aggregation. That would work if there's only a small number of application names. If there's a very large number of unique names, it's probably easiest to use logstash to break apart that string into an array and store the application name as its own field on the document.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split