Top X most used words in field

[toldiwaw]

Hi,
I wonder if there is a possibility to split field for unique words and count them for top hits?
My example is "message-subject" field.

Data table is fine form me (Visualize)

What I'm looking for (Result):
outgoing - 5
kibana - 4
tld - 4
visualize - 3
timeout - 2
filebeat - 1
... - ...

I would like to analyze logs from MTA, Exchange and maybe mailbox (imap input in logstash) in future...

[Marius_Dragomir]

The field you're trying to do the split is not analysed, hence the .keyword part of it so it's treated a complete string. You need to use the message-subject field which should be the one analyzed.

[toldiwaw]

Thanks. I'm not able to pick message-subject. Only .keyword

[toldiwaw]

Should I enable/update filed message-subject to fielddata?