# Unable to make a field aggregatable in kibana

**URL:** <https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912>\
**Category:** Elasticsearch\
**Created:** [December 22, 2018, 8:16am UTC](https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912 "2018-12-22T08:16:41Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![sid\_nikhil](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)\
**Post date:** [December 22, 2018, 2:16pm UTC](https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912/3 "2018-12-22T14:16:10Z")

</div>

I did this in Dev tools  
PUT /filebeat  
{

```
      "mappings": {

        "_doc": {

          "properties": {

            "message": {

              "type": "keyword"

            }

          }

        }

      }

    }

```

But still message field is not aggregatable  
 ![Capture_kibana_aggregation](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e4e4bb234b6bd38325536a9795f7563d99b2e825.png)

If my field is message , do you mean i should use message.doc\_values

This is my painless script to extract last word from message:  
String parts = /-/.split(doc['message'].value);  
return parts[-1]

Can you please explain with example . I am very new to ES/kibana.  
Thanks

---

_[View the full topic](https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912)._