# Start learning ELK

**URL:** <https://discuss.elastic.co/t/start-learning-elk/222139>\
**Category:** Elasticsearch\
**Created:** [March 4, 2020, 6:25pm UTC](https://discuss.elastic.co/t/start-learning-elk/222139 "2020-03-04T18:25:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 4, 2020, 6:25pm UTC](https://discuss.elastic.co/t/start-learning-elk/222139/1 "2020-03-04T18:25:27Z")

</div>

Hi All,

Can someone point me to the right direction to start learning ELK. I have gone through online and it looks like it is its is for older version. Any links might help

Cheers!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 4, 2020, 8:25pm UTC](https://discuss.elastic.co/t/start-learning-elk/222139/2 "2020-03-04T20:25:44Z")

</div>

What do you want to use it for?

---

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 5, 2020, 6:37am UTC](https://discuss.elastic.co/t/start-learning-elk/222139/3 "2020-03-05T06:37:24Z")

</div>

We use ES and kibana for log analysis. I can build basic dashboard on Kibana. There are at a times i would need to split the data and build the charts which i am not sure how to do it.

There are may more things I would need to do but because of limited tutorials available, unable to proceed further.

> [@HELP: Grouping and combine fields](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/2):
>
> @bharatchhajed The reason why it is showing 9 is because when you do a terms aggregation (for piechart) , each of these entries are unique terms (ABC-11-2019 for e.g. is not the same as ABC-01-2019). So the total unique terms turns out to be 9 and not 3. If you are using Logstash to ingest your logs, you could parse that field with something like below (if ABC or XYZ is always going to be in the beginning) ruby { code =\> "event.set('prefix', event.get('value').split('-').first)" } and t…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2020, 6:37am UTC](https://discuss.elastic.co/t/start-learning-elk/222139/4 "2020-04-02T06:37:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.