# Querying distinct sub message from elastic search

**URL:** <https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665>\
**Category:** Kibana\
**Created:** [April 6, 2020, 9:36am UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665 "2020-04-06T09:36:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinodvenugopal](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vinodvenugopal](https://discuss.elastic.co/u/vinodvenugopal)\
**Post date:** [April 6, 2020, 9:36am UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665/1 "2020-04-06T09:36:21Z")

</div>

Hi,

I am new to ELK stack and trying to create dashboard in Kibana for my project.  
I want to query distinct values in message. For example, I want to display number to messages received in Kafka topic.

````auto
         "_index" : "logstash",
         "_type" : "_doc",
         "_id" : "WT66QHEB2YAFk6q3dDms",
         "_score" : 5.038258,
         "_source" : {
           "type" : "java",
           "@timestamp" : "2020-04-03T15:48:13.477Z",
           "@version" : "1",
           "message" : "timestamp=03-Apr-2020::16:48:13.102 logLevel=ERROR className=c.l.f.x.orchestrator.Orchestrator topic= COUNTRY_ASSOCIATION PartyId=789 Member Not Found Error: Member not found!",
           "path" : "/tmp/logs/*.log",
         } ```

I want to find out how many distinct "Party Id" in topic 'COUNTRY_ASSOCIATION'? How can I implement the search query in Kibana/Elastic search
````

---

<div class="post-metadata">

**Author:** ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)\
**Post date:** [April 6, 2020, 10:40am UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665/2 "2020-04-06T10:40:08Z")

</div>

Welcome to Discuss and thank you for your interest in the ELK stack. To display a number of messages, you can create a Metric visualization with` Unique count` aggregation on `message` field. Then you can add this visualization to the Dashboard.  
As for extracting certain fields from the field, you will need to use a scripted term to rewrite the values. You can do this in the Advanced setting for your visualization:

[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-script](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-script)

---

<div class="post-metadata">

**Author:** ![vinodvenugopal](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vinodvenugopal](https://discuss.elastic.co/u/vinodvenugopal)\
**Post date:** [April 6, 2020, 11:43am UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665/3 "2020-04-06T11:43:24Z")

</div>

Thanks Maja. I will check the link.

---

<div class="post-metadata">

**Author:** ![vinodvenugopal](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vinodvenugopal](https://discuss.elastic.co/u/vinodvenugopal)\
**Post date:** [April 6, 2020, 12:01pm UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665/4 "2020-04-06T12:01:36Z")

</div>

Maja, Is there a way to extract text without using 'Painless' ? Do you have any example I can refer?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2020, 12:01pm UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665/5 "2020-05-04T12:01:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.