# Top X most used words in field

**URL:** <https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174>\
**Category:** Kibana\
**Created:** [December 26, 2018, 7:55pm UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174 "2018-12-26T19:55:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![toldiwaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/toldiwaw/32/39185_2.png) [@toldiwaw](https://discuss.elastic.co/u/toldiwaw)\
**Post date:** [December 26, 2018, 7:55pm UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174/1 "2018-12-26T19:55:24Z")

</div>

Hi,  
I wonder if there is a possibility to split field for unique words and count them for top hits?  
My example is "message-subject" field.

Data table is fine form me (Visualize)

What I'm looking for (Result):  
outgoing - 5  
kibana - 4  
tld - 4  
visualize - 3  
timeout - 2  
filebeat - 1  
... - ...

I would like to analyze logs from MTA, Exchange and maybe mailbox (imap input in logstash) in future...

 ![message-subject_01](https://us1.discourse-cdn.com/elastic/original/3X/7/3/732f192c1e5ede41ecf8331dba462a820e2faef6.png) ![message-subject_02](https://us1.discourse-cdn.com/elastic/original/3X/7/8/7857ddab3862d76c31ef7654a6d52c75df146fa8.png)

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [December 27, 2018, 10:34am UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174/2 "2018-12-27T10:34:42Z")

</div>

The field you're trying to do the split is not analysed, hence the .keyword part of it so it's treated a complete string. You need to use the `message-subject` field which should be the one analyzed.

---

<div class="post-metadata">

**Author:** ![toldiwaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/toldiwaw/32/39185_2.png) [@toldiwaw](https://discuss.elastic.co/u/toldiwaw)\
**Post date:** [December 27, 2018, 10:58am UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174/3 "2018-12-27T10:58:49Z")

</div>

Thanks. I'm not able to pick `message-subjec`t. Only .keyword ☹  
 ![message-subject_03](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c92e2c2d40588650ca92a55b2aae634d3357417d.png) ![message-subject_04](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60bbd803176b7b0631c81e8fe05241f4a7a1d82f.png)

---

<div class="post-metadata">

**Author:** ![toldiwaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/toldiwaw/32/39185_2.png) [@toldiwaw](https://discuss.elastic.co/u/toldiwaw)\
**Post date:** [January 3, 2019, 8:04pm UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174/4 "2019-01-03T20:04:53Z")

</div>

Should I enable/update filed `message-subject` to fielddata?

 ![message-subject_05](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0c829bfbc25eb90d9540e8afc4fb6d7ca8ca34d2.png) ![message-subject_06](https://us1.discourse-cdn.com/elastic/original/3X/9/9/990d1cdfddcbc0441b928c5c65f969a074617f22.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 8:04pm UTC](https://discuss.elastic.co/t/top-x-most-used-words-in-field/162174/5 "2019-01-31T20:04:54Z")

</div>

Closed on January 31, 2019, 8:04pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.