Would like to create a visulization that show ERROR, WARN and INFO

[111363 (Yaniv K)]

Hi,

I am trying to create visualization that show per specific log the count of ERROR, WARN & INFO messages.
I have tried to create the json input for getting all to message filed that contains [ERROR] but it did not show any.

How can I make it?

Thanks,
Yaniv

[ylasri (Yassine LASRI)]

You can add the error type bucket to your aggregtation

or use the filter aggregation as a bucket in your viz

[111363 (Yaniv K)]

Tried:

What do I do wrong?

[ylasri (Yassine LASRI)]

That should work if the field message is mapped as text

[111363 (Yaniv K)]

It gives me results while Discovering:

Does not it means it text?

[ylasri (Yassine LASRI)]

Yes if it gives results on discovery it should give same in viz