# Need help with aggregation on a column (having json stream)

**URL:** <https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [August 4, 2020, 7:30pm UTC](https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777 "2020-08-04T19:30:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pankaj\_Chopra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_chopra/32/73331_2.png) [@Pankaj\_Chopra](https://discuss.elastic.co/u/Pankaj_Chopra)\
**Post date:** [August 4, 2020, 7:30pm UTC](https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777/1 "2020-08-04T19:30:31Z")

</div>

Hi Team,  
Apologies, I am very new to Kibana, but definitely quite excited to do a lot of things.

We have a JSON stream on one of the column in each doc['Stream']

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/659252d9f87e9bed842ffe673d9bd49cb6eda7e9.png)

In the following example of JSON string in a document. I want to create pie-chart visualization (with split chart over 'rank'). Please note 'propositionName' = {Save, Device+Save, Plan+Device+Save}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/961c432c9a6f7b344e0d2f089e96ea315d9e190c.png)

So, basically I want to understand for rank-1 what's the split over propositionName.

Right now I don't have Stream field expanded in script or in logstash, not sure how to do it. Please provide recommendation, happy to provide more details.

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [August 12, 2020, 11:50am UTC](https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777/3 "2020-08-12T11:50:20Z")

</div>

Hey, it seems like the "stream" is indexed as a string field - Elasticsearch doesn't even know there is json inside. To change this, you can use the JSON logstash plugin: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html)

This won't be enough however, because Kibana doesn't support nested documents in this way as all keys are flattened during the indexing, which means the relationship between `rank` and `propositionName` gets lost.

To avoid this, you have to split up your documents to have a single document for each "proposition". You can use the split logstash plugin for this: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html)

---

<div class="post-metadata">

**Author:** ![Pankaj\_Chopra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_chopra/32/73331_2.png) [@Pankaj\_Chopra](https://discuss.elastic.co/u/Pankaj_Chopra)\
**Post date:** [August 13, 2020, 2:26pm UTC](https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777/4 "2020-08-13T14:26:35Z")

</div>

Thanks @flash1293 for providing information. I think I understand what you mean.  
Will it be possible for you to provide an example too to give more insight.  
Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2020, 2:26pm UTC](https://discuss.elastic.co/t/need-help-with-aggregation-on-a-column-having-json-stream/243777/5 "2020-09-10T14:26:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.