# Odd Pie chart filters behavior **URL:** \ **Category:** Kibana\ **Created:** [December 19, 2019, 4:35pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521 "2019-12-19T16:35:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 19, 2019, 4:35pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/1 "2019-12-19T16:35:33Z")
Hello. I'm trying to create a Pie chart to display values with filters. However, only the first 3 filters are working, while in the Discovery tab all of the filters work. How filters are really working? The official documentation doesn't anything about it. ![Screenshot from 2019-12-19 18-32-45](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6945027d0c710649b74a8e7e6b32f4c5c36c993d.png) ![hjhjhjhhj](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd67d0ca78e49bf3849f3711b1683a6e9ebd65fa.png) ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:10pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/2 "2019-12-20T13:10:04Z")
Can you try this by having the "nginx.access.url: api" filter in the Search bar at the top and only using the nginx.access.url in the filters fields in the Pie chart? ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:19pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/3 "2019-12-20T13:19:43Z")
I tried. It kinda worked but we want to have a bucket on Pie with counters by a wildcard, i.e. api/v1, api/v2, api/v3 (while a link is /api/v2/public, for example) and so forth. Is that even possible in a single Pie? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:21pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/4 "2019-12-20T13:21:29Z")
I'm not sure I understand exactly what you want. You'd like it to be split automatically by the version number? ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:23pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/5 "2019-12-20T13:23:23Z")
Yes. The number of hits of URLs (say, 10) by a complex wildcard or keyword. ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:26pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/6 "2019-12-20T13:26:32Z")
Can you try with a Terms aggregation instead of the Filter one, on the access URL field? ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:29pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/7 "2019-12-20T13:29:50Z")
Yes, I tried. Ended up with URLs like /api/v1/public/product1 and /api/v1/public/product2. As you see, those URLs are different and evaluated by Kibana separately. So it's two different counters. We want a single counter by '/api/v1/public' (which combines all counters in one). ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:33pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/8 "2019-12-20T13:33:49Z")
Then I'd suggest creating a scripted field that trims the URL to the third "/" and then do a terms aggregation on that field. > **[Using Painless in Kibana scripted fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)** > > This blog presents common use cases for Kibana scripted fields, and walks user through how to create scripted fields in a newly set-up Elastic Cloud instance. ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:35pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/9 "2019-12-20T13:35:46Z")
That's what I thought about first as I was trying to avoid any additional parsing. I'll post my solution later. Thanks for help! ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:36pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/10 "2019-12-20T13:36:40Z")
Best practice would be to do the parsing at ingest time, this way it's done only once. ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:38pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/11 "2019-12-20T13:38:16Z")
Do you mean by grok in a Logstash pipeline? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [December 20, 2019, 1:42pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/12 "2019-12-20T13:42:05Z")
Logstash pipelines or even ES pipelines if you don't already use Logstash. Even filebeat/metricbeat have the ability to do this operation as it's pretty simple. ---
**Author:** ![Devopsio](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@Devopsio](https://discuss.elastic.co/u/Devopsio)\ **Post date:** [December 20, 2019, 1:43pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/13 "2019-12-20T13:43:43Z")
Got it. Then I'll post my idea in a Logstash topic on that matter which for unknown reasons for me doesn't work. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2020, 1:43pm UTC](https://discuss.elastic.co/t/odd-pie-chart-filters-behavior/212521/14 "2020-01-17T13:43:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.