# Visualize List files from logs

**URL:** <https://discuss.elastic.co/t/visualize-list-files-from-logs/327944>\
**Category:** Kibana\
**Tags:** visualisation\
**Created:** [March 17, 2023, 2:55pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944 "2023-03-17T14:55:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oniriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oniriel/32/118579_2.png) [@Oniriel](https://discuss.elastic.co/u/Oniriel)\
**Post date:** [March 17, 2023, 2:55pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/1 "2023-03-17T14:55:33Z")

</div>

Hi,

I have an index that I try to create visualization on for monitoring. Some of the logs have the following structure

TEXT - path of a file - TEXT

the same file can appear multiple time in the logs

I can successfully create a search to get all the logs with this pattern, but I am trying to create a data table visualization to display the list of **unique** file in them

I couldn't figure out how to do that, can somebody point me to the proper resource ?

thanks

---

<div class="post-metadata">

**Author:** ![drewdaemon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewdaemon/32/97779_2.png) [@drewdaemon](https://discuss.elastic.co/u/drewdaemon)\
**Post date:** [April 11, 2023, 7:04pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/2 "2023-04-11T19:04:18Z")

</div>

Hi @Oniriel ! Welcome to the community.

So, I take it that your documents store that pattern in a field something like this?

```auto
{
    "_source": {
        ....
        "pattern": "TEXT - path of a file - TEXT"
    }
}

```

And you want a table where each row displays one of these patterns with no duplicates.

Is all this correct?

---

<div class="post-metadata">

**Author:** ![Oniriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oniriel/32/118579_2.png) [@Oniriel](https://discuss.elastic.co/u/Oniriel)\
**Post date:** [April 11, 2023, 7:22pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/3 "2023-04-11T19:22:21Z")

</div>

yes that is correct, I want to provide the list of file (without duplication) to the people using the dashboard to monitors the servers (all the logs are sent to Elasticsearch and then vizualized in Kibana)

So I was trying to find a way to extract the file path from the logs and then remove duplicates to create a table

---

<div class="post-metadata">

**Author:** ![drewdaemon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewdaemon/32/97779_2.png) [@drewdaemon](https://discuss.elastic.co/u/drewdaemon)\
**Post date:** [April 12, 2023, 5:07pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/4 "2023-04-12T17:07:37Z")

</div>

Are you on version 8.6 or higher? If so, you can do this using our "technical preview" SQL support.

First, you have to enable the `discover:enableSql` setting in advanced settings:

 ![Screenshot 2023-04-12 at 12.01.08 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/a/caaf98fc7f702f1c2e8bf72f3d2b72b936a12431.png)

Then, select SQL from the data view dropdown in Lens

 ![Screenshot 2023-04-12 at 12.02.09 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba3615bd49cdf420c868cc490b7577ad36294bc7.png)

Finally, write your SQL query. Let's say the field containing the pattern field is called "pattern". You could write

```auto
SELECT pattern, count(pattern) FROM 'my_index_pattern' GROUP BY pattern

```

Here is an example of this strategy, but the field in my example is called `geo.dest`:

 ![Screenshot 2023-04-12 at 12.05.25 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1768100a4b886da7d40a9347d4b336cbc88b251.png)

If you don't want to see the count column, you can always hide it

 ![Screenshot 2023-04-12 at 12.06.20 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc0a7f5755f8c8b1adc6bdc7c13d6e7a764a0711.png)

Does this help?

---

<div class="post-metadata">

**Author:** ![Oniriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oniriel/32/118579_2.png) [@Oniriel](https://discuss.elastic.co/u/Oniriel)\
**Post date:** [April 17, 2023, 3:38pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/5 "2023-04-17T15:38:46Z")

</div>

Hi,

I just came back from vacation, sorry for the delay. It seems we are using Kibana version 7.10

I will see what is available from what you proposed

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2023, 3:39pm UTC](https://discuss.elastic.co/t/visualize-list-files-from-logs/327944/6 "2023-05-15T15:39:18Z")

</div>

Closed on May 15, 2023, 3:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.