# Scripted fields to concatenate field names

**URL:** <https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382>\
**Category:** Elasticsearch\
**Created:** [October 23, 2017, 4:46pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382 "2017-10-23T16:46:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsuri](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@nsuri](https://community.grafana.com/u/nsuri)\
**Post date:** [October 23, 2017, 4:46pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/1 "2017-10-23T16:46:24Z")

</div>

I was trying to create a scripted field of my data by concatenating 2 fields so that I could group results on my dashboard in the x-axis by this field. I was able to do this in kibana by creating a scripted field as such:

```
return doc['srcAS'].value + '-' + doc['dstAS'].value

```

I was then able to create visualizations where this scripted field was used as the terms bucket for the x-axis.  
Is there anyway to do this in grafana?

Thanks,  
N

---

<div class="post-metadata">

**Author:** ![nsuri](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@nsuri](https://community.grafana.com/u/nsuri)\
**Post date:** [October 23, 2017, 5:30pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/2 "2017-10-23T17:30:27Z")

</div>

This is the query that I see Grafana sends to ES:

```
"{"search_type":"query_then_fetch","ignore_unavailable":true,"index":["sflow-2017.10.23","sflow-2017.10.24"]} {"size":0,"query":{"bool":{"filter":[{"range":{"@timestamp":{"gte":"1508731200000","lte":"1508817599999","format":"epoch_millis"}}},{"query_string":{"analyze_wildcard":true,"query":"*"}}]}},"aggs":{"3":{"terms":{"field":"srcAS.asn","size":10,"order":{"1":"desc"},"min_doc_count":1},"aggs":{"1":{"sum":{"field":"PacketSize"}},"2":{"date_histogram":{"interval":"1d","field":"@timestamp","min_doc_count":0,"extended_bounds":{"min":"1508731200000","max":"1508817599999"},"format":"epoch_millis"},"aggs":{"1":{"sum":{"field":"PacketSize","script":{"inline":"_value * doc['SampleRate'].value"}}}}}}}}} "

```

This is the request Kibana sends:

```
"query": {
  "bool": {
    "must": [
      {
        "query_string": {
          "analyze_wildcard": true,
          "query": "*"
        }
      },
      {
        "range": {
          "@timestamp": {
            "gte": 1508731200000,
            "lte": 1508817599999,
            "format": "epoch_millis"
          }
        }
      }
    ],
    "must_not": []
  }
},
"size": 0,
"_source": {
  "excludes": []
},
"aggs": {
  "3": {
    "terms": {
      "script": {
        "inline": "return doc['srcAS.asn'].value + '-' + doc['dstAS.asn'].value",
        "lang": "painless"
      },
      "size": 10,
      "order": {
        "2": "desc"
      },
      "valueType": "string"
    },
    "aggs": {
      "2": {
        "sum": {
          "field": "PacketSize",
          "script": "doc['PacketSize'].value * doc['SampleRate'].value * 0.000000000001"
        }
      }
    }
  }
}
}
```

---

<div class="post-metadata">

**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\
**Post date:** [October 24, 2017, 12:34pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/3 "2017-10-24T12:34:46Z")

</div>

Like this?

> [@Basic Elastic Search Query](https://community.grafana.com/t/basic-elastic-search-query/1543/4):
>
> This was a bit tricky but this seems to work using the script field. \_value in this case is the @number field and I am adding the @value field to it. [image]

---

<div class="post-metadata">

**Author:** ![nsuri](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@nsuri](https://community.grafana.com/u/nsuri)\
**Post date:** [October 25, 2017, 2:06pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/4 "2017-10-25T14:06:51Z")

</div>

It is somewhat like that, but instead of using that script field as a metric, I want to use it as the field for the “Group By” or X-axis bucket.

Currently, in Grafana, I have this:

 ![37 AM](https://us1.discourse-cdn.com/grafana/original/2X/f/f4ddb85b058e264c7f1c9b3c1347dcf77b68e313.png)

Where each of those numbers is a single field. I want to achieve something like this, where the metric is performed on an aggregation of 2 fields:

 ![36 AM](https://us1.discourse-cdn.com/grafana/original/2X/b/bb2faf57b278effff841d3f84a0cce734cc97479.png)

---

<div class="post-metadata">

**Author:** ![nsuri](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@nsuri](https://community.grafana.com/u/nsuri)\
**Post date:** [October 25, 2017, 2:32pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/5 "2017-10-25T14:32:39Z")

</div>

I notice I am able to do multiple “Group By” sections, and it gives me something closer to what I want in the legend. But it shows 100 total bars, when I want only 10.

---

<div class="post-metadata">

**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\
**Post date:** [October 25, 2017, 2:38pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/6 "2017-10-25T14:38:18Z")

</div>

I don’t know then - doesn’t look like it is currently possible.

---

<div class="post-metadata">

**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\
**Post date:** [October 25, 2017, 2:41pm UTC](https://community.grafana.com/t/scripted-fields-to-concatenate-field-names/3382/7 "2017-10-25T14:41:35Z")

</div>

This feature request was the closest I could find to what you need:

> <https://github.com/grafana/grafana/issues/3163>