# Parse a Json Field in a visualization **URL:** \ **Category:** Kibana\ **Created:** [January 24, 2018, 6:54pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913 "2018-01-24T18:54:13Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Kharma](https://avatars.discourse-cdn.com/v4/letter/k/ac8455/32.png) [@Kharma](https://discuss.elastic.co/u/Kharma)\ **Post date:** [January 24, 2018, 6:54pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/1 "2018-01-24T18:54:13Z")
I have a large group of data in Kibana that takes the form of below: // C:\Users\*\AppData\Local\FluxSoftware\Flux\flux.exe // C:\Users\*\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe Where \* is a username. I would like to track the count of each of these files based on the hostnames associated (in the same log) and return all files (not including path, so "flux.exe" or "OneDriveStandaloneUpdater.exe") that are found on 3 or less unique hosts. The issue I am having is determining a way to filter C:\Users\*\AppData\Local\FluxSoftware\Flux\flux.exe down to "flux.exe" to be able to create a visualization on it. Is there a good way to do this inside of kibana? ---
**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Post date:** [January 24, 2018, 7:35pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/2 "2018-01-24T19:35:29Z")
You could try to create a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) to extract the the path but the better solution is to exact the path during ingest. ---
**Author:** ![Kharma](https://avatars.discourse-cdn.com/v4/letter/k/ac8455/32.png) [@Kharma](https://discuss.elastic.co/u/Kharma)\ **Post date:** [January 24, 2018, 10:13pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/3 "2018-01-24T22:13:15Z")
Hello Nathan, Thank you for the quick response. After reading about Scripted fields it appears that it is only used for Computational data and doesn't allow me to split a field (essentially). Allowing data to be manipulated inside of Kibana seems like it would be a pretty common use case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2018, 10:13pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/4 "2018-02-21T22:13:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 22, 2018, 11:51pm UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/5 "2018-02-22T23:51:09Z")
Looks like @Nathan_Reese missed you're response. Actually scripted fields using the painless scripting language can parse and manipulate strings. If you still need help with it let me know. Regards, Lee ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 23, 2018, 12:58am UTC](https://discuss.elastic.co/t/parse-a-json-field-in-a-visualization/116913/6 "2018-02-23T00:58:17Z")
There's actually a similar example if getting the last `\` in a path here; > **[Using Painless in Kibana scripted fields | Elastic](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)** > > Kibana provides powerful ways to search and visualize data stored in Elasticsearch. For the purpose of visualizations, Kibana looks for fields defined in Elasticsearch mappings and presents them as op...