# Start learning ELK

**URL:** <https://discuss.elastic.co/t/start-learning-elk/222139>\
**Category:** Elasticsearch\
**Created:** [March 4, 2020, 6:25pm UTC](https://discuss.elastic.co/t/start-learning-elk/222139 "2020-03-04T18:25:27Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![bharatchhajed](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bharatchhajed](https://discuss.elastic.co/u/bharatchhajed)\
**Post date:** [March 5, 2020, 6:37am UTC](https://discuss.elastic.co/t/start-learning-elk/222139/3 "2020-03-05T06:37:24Z")

</div>

We use ES and kibana for log analysis. I can build basic dashboard on Kibana. There are at a times i would need to split the data and build the charts which i am not sure how to do it.

There are may more things I would need to do but because of limited tutorials available, unable to proceed further.

> [@HELP: Grouping and combine fields](https://discuss.elastic.co/t/help-grouping-and-combine-fields/222129/2):
>
> @bharatchhajed The reason why it is showing 9 is because when you do a terms aggregation (for piechart) , each of these entries are unique terms (ABC-11-2019 for e.g. is not the same as ABC-01-2019). So the total unique terms turns out to be 9 and not 3. If you are using Logstash to ingest your logs, you could parse that field with something like below (if ABC or XYZ is always going to be in the beginning) ruby { code =\> "event.set('prefix', event.get('value').split('-').first)" } and t…

---

_[View the full topic](https://discuss.elastic.co/t/start-learning-elk/222139)._