Search code examples
regexelasticsearchkibana-4

In kibana 4 i want to visualise a part of URL field to count

I had a field meta.uri. I want to visualize uri. I want a count of support and basic but not the full uri. it has 

/support/user/index?user=some
/support/mine/
/basic/index/
/basic/home?page=1

I want only starting part, like: 

support
basic
Solution

  • In Kibana4, you can setup a Filter sub aggregation and define each filter.

    In the "buckets" section, select "Split lines", then "Filters" for the aggregation type, then define the filter (e.g. myfield:myValue).

    If you have logstash, I would suggest making a new field for this value as the events are processed.