Kibana 4中的“子字符串不同”查询

Question

I would like to know how can I get a "distinct on substring" query in Kibana 4.

For example, I would to group "message" by a subsequence, such as this :

Row logs:

Timestamp  | Level | Message
2015-03-31 | ERROR | Something is wrong
2015-03-31 | ERROR | Something is still wrong
2015-03-31 | INFO  | Problem seams to be fixed
2015-03-31 | WARN  | There may be a problem

The expected result would be:

wrong:   2
problem: 2
fixed:   1

Any ideas?

Thanks in advance.

Answer 1

您可以通过在分析字段中使用术语（例如本例中的消息）来实现此目的。您可以在术语中包含想要的单词。