Top X most used words in field

I wonder if there is a possibility to split field for unique words and count them for top hits?
My example is "message-subject" field.

Data table is fine form me (Visualize)

What I'm looking for (Result):
outgoing - 5
kibana - 4
tld - 4
visualize - 3
timeout - 2
filebeat - 1
... - ...

I would like to analyze logs from MTA, Exchange and maybe mailbox (imap input in logstash) in future...

The field you're trying to do the split is not analysed, hence the .keyword part of it so it's treated a complete string. You need to use the message-subject field which should be the one analyzed.

Thanks. I'm not able to pick message-subject. Only .keyword :frowning:
message-subject_03 message-subject_04

Should I enable/update filed message-subject to fielddata?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.