# Visualize - How to visualize on a field using fuzzy logic

**URL:** <https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072>\
**Category:** Kibana\
**Created:** [July 19, 2021, 1:54pm UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072 "2021-07-19T13:54:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![MWLonKso](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\
**Post date:** [July 19, 2021, 1:54pm UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/1 "2021-07-19T13:54:26Z")

</div>

Hi All

This might be a bit of a strange question and hopefully someone can just point me straight at some documentation. I want to visualize on a text field where I know that part of the message will contain a fixed string (from a small collection of strings, e.g. INFO, WARN, ERROR, CRIT, DEBUG). Ideally I'd like to be able to create a Pie Chart for this to show percentages of each of the types of collection. Can someone point me to or provide me with a simple concise method for doing this?

TIA

Kind Regards

Marcus Webb

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [July 19, 2021, 2:07pm UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/2 "2021-07-19T14:07:34Z")

</div>

Try the "Filters" aggregation in Lens to define KQL for each bucket. There's an example of defining this in the Kibana guide....the example has this trended over time but you could use a pie chart + "filters" aggregation to use a pie (or treemap!). [Time series analysis with Lens | Kibana Guide [7.13] | Elastic](https://www.elastic.co/guide/en/kibana/current/create-a-dashboard-of-panels-with-ecommerce-data.html#percentage-stacked-area)

---

<div class="post-metadata">

**Author:** ![MWLonKso](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\
**Post date:** [July 19, 2021, 2:27pm UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/3 "2021-07-19T14:27:26Z")

</div>

Hi @ghudgins

Thanks for this - our current implementation of Kibana doesn't sadly have Lens installed, it would seem. Is there another way?

Also it appears as though there's things in our message string over and above this that start with specific phrases (e.g. "Glue Crawler", "Unknown Exception", "unexpected row count" etc) that would be useful to map. Would such a thing be possible within this framework?

Kind Regards

Marcus Webb

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [July 19, 2021, 9:47pm UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/4 "2021-07-19T21:47:08Z")

</div>

What version of the Elastic Stack are you on?

---

<div class="post-metadata">

**Author:** ![MWLonKso](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\
**Post date:** [July 20, 2021, 7:41am UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/5 "2021-07-20T07:41:06Z")

</div>

I am using 7.10.2 - I've found a workaround for this particular case but it would be useful if there is a "non-Lens based" methodology I could follow in case this arises in future.

---

<div class="post-metadata">

**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\
**Post date:** [July 20, 2021, 11:06am UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/6 "2021-07-20T11:06:57Z")

</div>

Hi @MWLonKso,  
filters aggregation exists also in the Visualize editor so there's no need to use Lens if you want to avoid it. The KQL syntax is used in both places so the tutorial sent by @ghudgins can still be useful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2021, 11:07am UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072/7 "2021-08-17T11:07:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
