# Visualise '(www.|)site.com' terms agg in weblogs **URL:** \ **Category:** Kibana\ **Created:** [April 13, 2016, 1:18pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251 "2016-04-13T13:18:47Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![tomr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomr/32/48260_2.png) [@tomr](https://discuss.elastic.co/u/tomr)\ **Post date:** [April 13, 2016, 1:18pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/1 "2016-04-13T13:18:47Z")
I have weblogs for a bunch of sites, and the logs go into ES with either [site.com](http://site.com) or [www.site.com](http://www.site.com) (and sometimes, but not often, [a.site.com](http://a.site.com) [b.site.com](http://b.site.com) and so on) I'm thinking about splitting this on the way in into [site.com](http://site.com) and prefixes, so I can easily visualise using a terms agg for 'top 50 sites' in Kibana Currently I can't figure out how to merge the totals for [www.site.com](http://www.site.com) and [site.com](http://site.com) in a Kibana vis - is there a way I can do this without reindexing? ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [April 13, 2016, 10:10pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/2 "2016-04-13T22:10:51Z")
The cleanest way to do this would probably be to fix the data, but in Kibana what I would probably do is create two separate visualizations, one that filters for [site.com](http://site.com) and [www.site.com](http://www.site.com), and one that filters for the inverse (NOT [site.com](http://site.com) AND NOT [www.site.com](http://www.site.com)). Then you could put them side by side in a dashboard to get a view across the entire data set. ---
**Author:** ![tomr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomr/32/48260_2.png) [@tomr](https://discuss.elastic.co/u/tomr)\ **Post date:** [April 13, 2016, 11:53pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/3 "2016-04-13T23:53:08Z")
How would that solve for 'top 50 sites' ? If I were going to make 50 visualisations, I'd be better off making 50 filters and using a single viz with a filter agg ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [April 14, 2016, 3:26pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/4 "2016-04-14T15:26:07Z")
It sounded to me like you essentially wanted a top 50 terms agg with the counts for `site.com` and `www.site.com` combined. I'm not sure how you'd achieve that with a single visualization, so my thinking was that you could create one visualization with the count for `site.com` + `www.site.com` and a second visualization with a top 50 terms agg on just the subdomains. But perhaps I've misinterpreted your question. Could you provide a little more detail on what the data looks like? I assumed the domain was static and only the subdomains change, maybe that's incorrect? ---
**Author:** ![tomr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomr/32/48260_2.png) [@tomr](https://discuss.elastic.co/u/tomr)\ **Post date:** [April 14, 2016, 3:54pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/5 "2016-04-14T15:54:51Z")
[site1.com](http://site1.com) [www.site1.com](http://www.site1.com) [site2.com](http://site2.com) > **[Site2](https://www.site2.com/)** > > Go Beyond Compliance [site3.com](http://site3.com) [www.site3.com](http://www.site3.com) [weird.site3.com](http://weird.site3.com) [site4.com](http://site4.com) [www.site4.com](http://www.site4.com) etc ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [April 14, 2016, 4:32pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/6 "2016-04-14T16:32:04Z")
Ah I see, that is more complicated. So for site3, `www.site3.com`, `site3.com`, and `weird.site3.com` should _all_ count towards [site3.com](http://site3.com) in the terms agg, is that right? Since you already seem to be using Groovy scripting, I assume you've tried creating a scripted field that strips the subdomain? Does that not work for some reason? ---
**Author:** ![tomr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomr/32/48260_2.png) [@tomr](https://discuss.elastic.co/u/tomr)\ **Post date:** [July 20, 2016, 2:51am UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/7 "2016-07-20T02:51:11Z")
[quote="Bargs, post:6, topic:47251"] Ah I see, that is more complicated. So for site3, [www.site3.com](http://www.site3.com), [site3.com](http://site3.com), and [weird.site3.com](http://weird.site3.com) should all count towards [site3.com](http://site3.com) in the terms agg, is that right?[/quote] Exactly > [@Bargs](#): > > Since you already seem to be using Groovy scripting, I assume you've tried creating a scripted field that strips the subdomain? Does that not work for some reason? Cool idea - would you be able to give an example of how this would be done? ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 20, 2016, 1:36pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/8 "2016-07-20T13:36:54Z")
I imagine you could split the string on dots, remove the first element if there are greater than 2 array elements (in other words, there's a subdomain), and then rejoin with dots? Or maybe a regex would work, but I imagine that would be slower. You might also be able to accomplish this with a value script in the advanced options of the terms agg itself instead of a scripted field: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#\_value\_script\_8](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_value_script_8) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/visualise-www-site-com-terms-agg-in-weblogs/47251/9 "2017-07-06T13:45:31Z")
Closed on July 6, 2017, 1:45pm UTC