# Visualizing fields extracted from logs

**URL:** https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285
**Category:** Kibana
**Created:** [March 23, 2016, 10:31pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285 "2016-03-23T22:31:23Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 23, 2016, 10:31pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285/1 "2016-03-23T22:31:23Z")

</div>

So I have logs successfully coming in from a remote server into elasticsearch through logstash agents and I am trying to visualize it on kibana.

In the discover tab I see the fields that I have extracted using grok filter --good  
However, when i click on visualize tab Piechart -\> new search -\> split slices -\> aggregation -\> terms -\> field -\> ???

I do not the see the fields I have extracted to be able to visualize them.  
This is the discover tab

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0ce84d51c0c8cf28b3f6b8ac0e5b873bea420596.PNG)  
this is the visualize tab  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0a3a56d0f0d459e81272f0d5f0542ba03df4f76f.JPG)

Please help! I am trying to visualize fields i have extracted..

---

<div class="post-metadata">

### Author: ![Khalah\_Jones\_Golden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khalah_jones_golden/32/7169_2.png) [@Khalah\_Jones\_Golden](https://discuss.elastic.co/u/Khalah_Jones_Golden)
#### Post date: [March 23, 2016, 10:42pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285/2 "2016-03-23T22:42:31Z")

</div>

The type for your fields hasn't been set correctly. when you look at the fields in discover you see they have '?' next to them which means that the type for those fields isn't set and couldn't be interpreted, or perhaps you have different value types for those fields spread throughout your index.

If you look into properly setting field types using logstash and grok that should give you guidance.

Peace,  
Khalah

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 23, 2016, 10:50pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285/3 "2016-03-23T22:50:06Z")

</div>

Hi, Thanks for your reply.  
the log looks like this:  
2016-03-22 00:4110|mayan|searchVendor|2509

below is the grok filter I applied

grok {  
match =\> ["message", "%{DATE:todaysdate} %{SECOND:seconds}%{NOTSPACE}%{WORD:Username}%{NOTSPACE}%{WORD:Vendorname}%{NOTSPACE}%{BASE16NUM:bytes}"]  
}

I'm not sure how it doesn't match the type?

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 23, 2016, 11:40pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285/4 "2016-03-23T23:40:57Z")

</div>

I fixed the problem by refreshing the fields.  
Steps:  
Kibana.  
Settings  
Reload field list.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:58pm UTC](https://discuss.elastic.co/t/visualizing-fields-extracted-from-logs/45285/5 "2017-07-06T13:58:02Z")

</div>