# Kibana Timelion and Pie Chart groupings

**URL:** <https://discuss.elastic.co/t/kibana-timelion-and-pie-chart-groupings/93457>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [July 17, 2017, 9:09pm UTC](https://discuss.elastic.co/t/kibana-timelion-and-pie-chart-groupings/93457 "2017-07-17T21:09:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [July 17, 2017, 9:09pm UTC](https://discuss.elastic.co/t/kibana-timelion-and-pie-chart-groupings/93457/1 "2017-07-17T21:09:53Z")

</div>

I am currently working on a project that reads in logs from a file. The problem is that these logs roll over often and therefore have names like support.csv, support1.csv, etc. In Kibana visulations like Timelion and Pie Chart I want to view them all as one (i.e. support\*.csv). Currently they look like this:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/9/29f2e3171598b3c4a58dcad9193db0aa51490c60.png)  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d25852dd85d7a9ab3efabd1b0e47f70823f22cf.png)

And the timelion:

![](https://us1.discourse-cdn.com/elastic/original/3X/4/6/4619e0c898c62cd28c8115775f62c7eda73c8aae.png)

So basically I want all of the log files that come from support\*.csv to be stored as one group and likewise for all of the other file types (syslog\*.prn, debug\*.prn, etc)

Is this possible?

Thanks!

---

<div class="post-metadata">

**Author:** ![BigFunger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigfunger/32/7323_2.png) [@BigFunger](https://discuss.elastic.co/u/BigFunger)\
**Post date:** [July 18, 2017, 9:56pm UTC](https://discuss.elastic.co/t/kibana-timelion-and-pie-chart-groupings/93457/2 "2017-07-18T21:56:29Z")

</div>

How are you ingesting the data into elasticsearch? Is that an enrichment that can be done at index time?

You can accomplish this using a scripted field, although this comes with a couple of caveats.

- First, you need to enable regex in scripts in elasticsearch.yml.  
`script.painless.regex.enabled`
- Second, manipulating your data like this at query time can incur significant performance costs.

If you still want to continue, this is what I did to accomplish this.

1. Create a new scripted field for your index pattern. Use the following script, or modify it to meet your needs:

```auto
def m = /([A-Za-z]*)([0-9]*).([A-Za-z]*)/.matcher(doc['filename'].value); if ( m.matches() ) { return m.group(1) + "." + m.group(3); } else { return "no 
 match"; }

```

![](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6aa17176884dbf8592e592881f87e02c42dcebdd.gif)

1. On discover, note that your scripted field is working correctly:  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb5f654741bd9f91a5033986f3b1629b2137d200.png)

2. Point your visualization at the scripted field  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53ec62698e019a513999daee483f3ac1666b672e.png)

Note, I'm not sure that scripted fields work with Timelion yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2017, 9:56pm UTC](https://discuss.elastic.co/t/kibana-timelion-and-pie-chart-groupings/93457/3 "2017-08-15T21:56:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.