# Querying of JSON fields
**URL:** https://discuss.elastic.co/t/querying-of-json-fields/83688
**Category:** Kibana
**Created:** [April 26, 2017, 11:38am UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688 "2017-04-26T11:38:16Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@rahul\_surya](https://discuss.elastic.co/u/rahul_surya)
#### Post date: [April 26, 2017, 11:38am UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/1 "2017-04-26T11:38:16Z")
{"subscriber1": {"Downlink Bytes": "1.47kb", "id": "25.25.25.2", "Uplink Pkts": "8", "Downlink Pkts": "8", "DNS": {"start time": "12:27:27", "Downlink Bytes": "249", "Uplink Pkts": "1", "Downlink Pkts": "1", "Uplink Bytes": "84", "end time": "12:27:27"}, "Uplink Bytes": "682", "FACEBOOK": {"start time": "12:27:21", "Downlink Bytes": "956", "Uplink Pkts": "4", "Downlink Pkts": "4", "Uplink Bytes": "304", "end time": "12:27:26"}}}
{"subscriber2": {"Downlink Bytes": "1.47kb", "id": "25.25.25.2", "Uplink Pkts": "8", "Downlink Pkts": "8", "DNS": {"start time": "12:27:27", "Downlink Bytes": "249", "Uplink Pkts": "1", "Downlink Pkts": "1", "Uplink Bytes": "84", "end time": "12:27:27"}, "Uplink Bytes": "682", "FACEBOOK": {"start time": "12:27:21", "Downlink Bytes": "956", "Uplink Pkts": "4", "Downlink Pkts": "4", "Uplink Bytes": "304", "end time": "12:27:26"}}}
I have above json format for two subscribers having differnet application information for each subscriber .So on dashboard i have to show like two pie charts for subscriber1 and subscriber2,subscriber1 must show application usage in bytes as pie chart,similarly [subscriber2.so](http://subscriber2.so) how can i query to show multiple applications,i have tried the querying "subscriber1.\*.downlink bytes" \* represent multiple application fields but it is not querying by [kibana.so](http://kibana.so) how can we do it?
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 26, 2017, 3:02pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/2 "2017-04-26T15:02:59Z")
Hi Rahul,
How was this data loaded into Elasticsearch?
I tried just posting it to Elasticsearch using Kibana dev tools console like;
```auto
POST test1/test
POST test1/test
{
"subscriber1": {
"Downlink Bytes": "1.47kb",
"id": "25.25.25.2",
"Uplink Pkts": "8",
"Downlink Pkts": "8",
"DNS": {
"start time": "12:27:27",
"Downlink Bytes": "249",
"Uplink Pkts": "1",
"Downlink Pkts": "1",
"Uplink Bytes": "84",
"end time": "12:27:27"
},
"Uplink Bytes": "682",
"FACEBOOK": {
"start time": "12:27:21",
"Downlink Bytes": "956",
"Uplink Pkts": "4",
"Downlink Pkts": "4",
"Uplink Bytes": "304",
"end time": "12:27:26"
}
}
}
```
And then I tried building a visualization of pie charts (one for each subscriber) and splitting each pie by percentage of data for each app (like FACEBOOK). I added another copy of the data where I replaced FACEBOOK with GOOGLE.
The Kibana Discover view of one doc looks like this;
But if you want to split on the application like FACEBOOK it needs to be the value of a field, not the name of a field.
And likewise, it would be better if subscriber2 were the value of a field.
As a simplified example;
```auto
POST test2/test
{
"subscriber": "subscriber1",
"Downlink Bytes": "1.47kb",
"id": "25.25.25.2",
"Uplink Pkts": "8",
"Downlink Pkts": "8",
"Uplink Bytes": "682",
"application" : "FACEBOOK"
}
POST test2/test
{
"subscriber": "subscriber1",
"Downlink Bytes": "1.47kb",
"id": "25.25.25.2",
"Uplink Pkts": "8",
"Downlink Pkts": "8",
"Uplink Bytes": "682",
"application" : "GOOGLE"
}
POST test2/test
{
"subscriber": "subscriber2",
"Downlink Bytes": "1.47kb",
"id": "25.25.25.2",
"Uplink Pkts": "8",
"Downlink Pkts": "8",
"Uplink Bytes": "682",
"application" : "FACEBOOK"
}
POST test2/test
{
"subscriber": "subscriber2",
"Downlink Bytes": "1.47kb",
"id": "25.25.25.2",
"Uplink Pkts": "8",
"Downlink Pkts": "8",
"Uplink Bytes": "682",
"application" : "GMAIL"
}
```
Looks like this in Kibana Discover;
That allows me to `split chart` on the subscriber.keyword (it's had to see but there is a legend to the left of the top pie that says "subscriber1" and to the left of the bottom pie that says "subscriber2" because I split charts on subscriber.keyword).
And each pie is `split slices`on the application.keyword.
---
### Author:  [@rahul\_surya](https://discuss.elastic.co/u/rahul_surya)
#### Post date: [April 27, 2017, 9:07am UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/3 "2017-04-27T09:07:16Z")
Thanks LeeDr,for your [output.So](http://output.So) i can follow the second approach you mentioned in simplified example .And one more doubt,these are some dynamic logs means we can get the subscribers 10 to 20 in number,so that can we have to adjust space and draw the pie per subscriber automatically .means if two subscribers came it has draw two pie charts and if 5 subsribers came it has to draw 5 pie charts like that no empty spaces must present on the dashboard ,can we configure that on kibana-3.0.0
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 27, 2017, 12:49pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/4 "2017-04-27T12:49:17Z")
Yes, if you look at the left panel where I did the `Split Chart` (makes multiple Pie charts) I have the `Size` field set to the default of 5. But I only have 2 subscribers so it only shows 2 pies. You would want to set that up higher to be above your maximum number of subscribers (I'm not sure how large it will allow).
The other `Split Slices` also has the default size of 5. So you might need to increase that if you want to see more than that many applications. Right now it's going to show the top 5.
Regards,
Lee
---
### Author:  [@rahul\_surya](https://discuss.elastic.co/u/rahul_surya)
#### Post date: [April 27, 2017, 1:49pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/5 "2017-04-27T13:49:08Z")
Can we do this kind of configuration on kibana -3.0 also?
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 27, 2017, 2:29pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/6 "2017-04-27T14:29:20Z")
Sorry but I don't have any idea on Kibana 3.0. You could try it and tell us.
Lee
---
### Author:  [@rahul\_surya](https://discuss.elastic.co/u/rahul_surya)
#### Post date: [April 28, 2017, 6:53am UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/7 "2017-04-28T06:53:35Z")
yeah i checked it LeeDr from kibana 4.0 that split chart support is there.
One more thing i have json dashboard implemented in kibana 3.0 ,so can i tried o export that same dashboard to kibana-5.0 and it is not accepting,so can we export same dashboard or do we need to create new dashboard again?
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [April 28, 2017, 2:02pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/8 "2017-04-28T14:02:33Z")
There's not any migration of dashboards (or visualizations) from Kibana 3 to Kibana 4 or 5. You will have to recreate them.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 26, 2017, 2:14pm UTC](https://discuss.elastic.co/t/querying-of-json-fields/83688/9 "2017-05-26T14:14:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.