# Top message visualization - how to filter **URL:** \ **Category:** Kibana\ **Created:** [May 13, 2016, 7:20am UTC](https://discuss.elastic.co/t/top-message-visualization-how-to-filter/49968 "2016-05-13T07:20:28Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 13, 2016, 7:20am UTC](https://discuss.elastic.co/t/top-message-visualization-how-to-filter/49968/1 "2016-05-13T07:20:28Z")
Hi, I'm working with Syslog data from routers and switches and am trying to make a visualization that shows me what type of message is coming in the most. Like a top 5 message kind of thing so we can quickly see what we deal with the most. When I try to make a pie chart and split it up based on the syslog\_message field I get results, but they don't make sense. This is what I end up with [https://i.gyazo.com/e35a865117295121a3b0d4aaf1fdfea2.png](https://i.gyazo.com/e35a865117295121a3b0d4aaf1fdfea2.png) The message fields include the following which I want to sort it on "APPTRACK\_SESSION\_VOL\_UPDATE", "APPTRACK\_SESSION\_CLOSE", "CHASSISD\_IPC\_UNEXPECTED\_RECV" and a few more. The message field is just a bunch of text, but how do I filter it out? ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 13, 2016, 8:01am UTC](https://discuss.elastic.co/t/top-message-visualization-how-to-filter/49968/2 "2016-05-13T08:01:50Z")
[http://pastebin.com/eJY1xfDp](http://pastebin.com/eJY1xfDp) This is what it looks like. What I want to do is make a visualisation that shows me what message I get the most. Some are unique and others aren't so is there a way to filter it in a way so it looks at the first few characters since that's all we need to determine what message it is. ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 13, 2016, 10:52am UTC](https://discuss.elastic.co/t/top-message-visualization-how-to-filter/49968/3 "2016-05-13T10:52:32Z")
I had to use the .raw version of the field ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/top-message-visualization-how-to-filter/49968/4 "2017-07-06T13:53:25Z")
Closed on July 6, 2017, 1:53pm UTC