# Transforming an existing variable and creating a useable new one in Kibana

**URL:** https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734
**Category:** Kibana
**Created:** [January 16, 2017, 12:57pm UTC](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734 "2017-01-16T12:57:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Hicham\_Mouddi](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@Hicham\_Mouddi](https://discuss.elastic.co/u/Hicham_Mouddi)
#### Post date: [January 16, 2017, 12:57pm UTC](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734/1 "2017-01-16T12:57:24Z")

</div>

Hello,

I would like to create a visualisation on Kibana that aggregate documents by a specific field. However the existing field (lets call it interaction\_name) is built as follow :

**Name\_Interaction | Number**

I want to create a new field that contains only the **Name\_Interaction** (delete "| Number") to allow the aggregation by this new field.

How can I do that, without creating the field in my database? Is there a function regexp that I can implement in the Console and update the index ?

Thanks in advance,

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [January 18, 2017, 8:20pm UTC](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734/2 "2017-01-18T20:20:55Z")

</div>

Hi Hicham,

There's a couple of possible solutions for your issue. But I think it depends on if you're still loading additional data for this index (or index pattern in Kibana).

If you're not loading additional data, I think you can add a field and re-index the existing data and use a script to split the interaction\_name field into it's own name\_interaction field. You would have to run this every time more data was loaded.

If you're loading additional data, you would probably want to change the process loading the data into Elasticsearch to load name\_interaction as a separate field.

And lastly, you could create a scripted field in Kibana to split out the data you want. Here's a blog post about that;

> **[Using Painless in Kibana scripted fields
	  	 | Elastic](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)**
>
> Kibana provides powerful ways to search and visualize data stored in Elasticsearch. For the purpose of visualizations, Kibana looks for fields defined in Elasticsearch mappings and presents them as op...

  
(look for the "Return substring" example).

I would probably try the Painless scripted field in Kibana first. If you decide to re-index data into Elasticsearch you might end up re-using the Painless script in that operation anyway.

Regards,  
Lee

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2017, 8:21pm UTC](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734/3 "2017-02-15T20:21:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
