# Kibana need to combine results or change filter

**URL:** https://discuss.elastic.co/t/kibana-need-to-combine-results-or-change-filter/39264
**Category:** Kibana
**Created:** [January 14, 2016, 7:45pm UTC](https://discuss.elastic.co/t/kibana-need-to-combine-results-or-change-filter/39264 "2016-01-14T19:45:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)
#### Post date: [January 14, 2016, 7:45pm UTC](https://discuss.elastic.co/t/kibana-need-to-combine-results-or-change-filter/39264/1 "2016-01-14T19:45:42Z")

</div>

I have created a grok filter that is correctly labeling the fields in Kibana, but now I want to see if I can make a filter or do something within side Kibana to meet my needs.

I have a data table visualization created that has the name of student applications example below:

edu.utah.acs.student.coupledapps.commonejb.lib.ACSHandler 2,323  
edu.utah.acs.student.coupledapps.studentfinance.ejb.StudentFinanceServicesBean 268  
edu.utah.acs.student.coupledapps.commonejb.util.student.ClassDataPopulator 88

Problem: I want to combine these results. Everything that has "edu.utah.acs.student.coupledapps" I want to combine the count for. "coupledapps" is the app name and everything after belongs to the same app so I want it represented count wise as the same app.

Best,  
Monty

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [January 14, 2016, 8:10pm UTC](https://discuss.elastic.co/t/kibana-need-to-combine-results-or-change-filter/39264/2 "2016-01-14T20:10:39Z")

</div>

Depending on how many unique application names you have, you might be able to use the "Filters" aggregation. That would work if there's only a small number of application names. If there's a very large number of unique names, it's probably easiest to use logstash to break apart that string into an array and store the application name as its own field on the document.

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:04pm UTC](https://discuss.elastic.co/t/kibana-need-to-combine-results-or-change-filter/39264/3 "2017-07-06T14:04:58Z")

</div>


