{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/10899","labels_url":"https://api.github.com/repos/elastic/elasticsearch/issues/10899/labels{/name}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/10899/comments","events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/10899/events","html_url":"https://github.com/elastic/elasticsearch/issues/10899","id":72118690,"number":10899,"title":"Feature Request: Aggregation on partial field value","user":{"login":"stuartjk1606","id":12169851,"avatar_url":"https://avatars.githubusercontent.com/u/12169851?v=3","gravatar_id":"","url":"https://api.github.com/users/stuartjk1606","html_url":"https://github.com/stuartjk1606","followers_url":"https://api.github.com/users/stuartjk1606/followers","following_url":"https://api.github.com/users/stuartjk1606/following{/other_user}","gists_url":"https://api.github.com/users/stuartjk1606/gists{/gist_id}","starred_url":"https://api.github.com/users/stuartjk1606/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stuartjk1606/subscriptions","organizations_url":"https://api.github.com/users/stuartjk1606/orgs","repos_url":"https://api.github.com/users/stuartjk1606/repos","events_url":"https://api.github.com/users/stuartjk1606/events{/privacy}","received_events_url":"https://api.github.com/users/stuartjk1606/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-04-30T10:12:20Z","updated_at":"2015-05-04T11:38:07Z","closed_at":"2015-05-04T11:38:07Z","body":"I have a number of different load injector boxes and processes that generate load through our system under test. The tool in use produces masses of logs out but none of it is easily accessible or readable. I am therefore using ELK to process the loads with success, however, presenting some of the data is problematic.\r\n\r\nThe process names have a structure of:\r\n<process>_<name>_Stress<nn>_Thread_<nn>\r\nbut there are around 180 of them. Each process thread generates 1 of 11 different message types. The message types are only distinguishable using a 10 character substring within a field containing strings and semi_colon delimited text and generally in the same location (between character 60 and character 70.\r\n\r\nIn elasticsearch none of these fields are analysed as this makes the queries and results even messier in Kibana and poses the same problem when choosing analysed elements of a field (only picking element 1&2 or 10-12).\r\n\r\nWhen aggregation is done on either of these fields, \"message type\" is presented as the long string in the visualisation key with only the first 10-15 characters showing, and \"process name\" resutls in all 180 processes rather than the 7 process types.\r\n\r\nThese processes are likely to change over time as we introduce new test scenarios and message types so I do not want to hard code them in just in case we miss something.\r\n\r\nIs it possible to have elasticsearch return substrings, partials, lefts, rights etc of a field and group them as such rather than the entire field content so all <process>_<name>a are grouped together and *<msg_type>A* are grouped together? Ideally without code edits to either elastic or kibana? Something in JSON Input such as { \"field_length\": 10 } or { \"partial_start\": 60, \"partial_for\": 15 } would suffice."}}