# Show top 100 most occured errors from log
**URL:** https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339
**Category:** Kibana
**Created:** [December 2, 2020, 10:27am UTC](https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339 "2020-12-02T10:27:38Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@5JrA2ngS8Snub](https://discuss.elastic.co/u/5JrA2ngS8Snub)
#### Post date: [December 2, 2020, 10:27am UTC](https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339/1 "2020-12-02T10:27:38Z")
FYI: I'm new to using the ELK stack.
I want to have more (easier) insight into the apache error log data my servers are producing. My plan is to create dashboards that will show me the information I need. One of the most important things I want to know is: what is the most common error in my application for a period of X hours.
So I created a test environment using elasticsearch, logstash and filebeat. I have data coming in from a test application. This data is coming from a apache error log that is send to logstash using filebeat and the `GROK` extension.
I need some hints on how to create such top 100 error, I assume I have to do some kind of aggregation on the `message` field. But is this something I need to implement into the logstash or filebeat config or just in the Kibana interface when creating a dashboard?
Any advice to get me started would be appreciated
A simple representation of the output I would like to have in my dashboard:
```
# Count: Error:
1 400 'Unable to call undefined function testx'
2 20 'Var X cannot be NULL'
... ... ....
```
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [December 2, 2020, 2:40pm UTC](https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339/2 "2020-12-02T14:40:39Z")
Hi and welcome to our community!
You can certainly do this in Kibana, here's a similar case showing e.g. top referer in Kibana Lens
Similar stuff you can do with error messages. Takes 2 few clicks to build such a table there. Dragging the fields to the panel, choosing Data Table as Visualization, ready.
Best,
Matthias
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [December 2, 2020, 7:18pm UTC](https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339/3 "2020-12-02T19:18:50Z")
One thing that's important is that you need to be able to aggregate on the field. Typically `message` fields are indexed as full text, but you will need to use a keyword field if you want to aggregate. There is more detail about this in the [Elasticsearch text field docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2020, 7:19pm UTC](https://discuss.elastic.co/t/show-top-100-most-occured-errors-from-log/257339/4 "2020-12-30T19:19:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.