title: Grouping documents in elastic search using tokenizer
body: <p>I have no deep knowledge of ES but my boss gave me the task to aggregate/group error messages, so we can see how often an error message appears.</p>
  
  <p>The documents look like</p>
  
  <pre><code>{
    "_index": "fluentd.php.error.20191223",
    "_type": "_doc",
    "_id": "0zYPM28B9xbIWtpXrXSt",
    "_version": 1,
    "_score": null,
    "_source": {
      "message": "WARNING Invalid argument supplied for foreach() /var/www/class/bootstrap.php:9 /product-1",
      "hostname": "webserver-1",
      "@timestamp": "2019-12-23T14:19:04+0100",
      "@log_name": "php.error"
    },
    "fields": {
      "@timestamp": [
        "2019-12-23T14:19:04.000Z"
      ]
    },
    "sort": [
      1577109544000
    ]
  }
  </code></pre>
  
  <pre><code>{
    "_index": "fluentd.php.error.20191223",
    "_type": "_doc",
    "_id": "0zYPM28B9xbIWtpXrXSt",
    "_version": 1,
    "_score": null,
    "_source": {
      "message": "WARNING Invalid argument supplied for foreach() /var/www/class/bootstrap.php:9 /newsletter.html",
      "hostname": "webserver-1",
      "@timestamp": "2019-12-23T14:19:04+0100",
      "@log_name": "php.error"
    },
    "fields": {
      "@timestamp": [
        "2019-12-23T14:19:04.000Z"
      ]
    },
    "sort": [
      1577109544000
    ]
  }
  </code></pre>
  
  <p>The culprit here is, both <strong>message</strong> differ but concern the same error in the same file (under different url).</p>
  
  <p>Is it even possible for ES to detect this kind of semantic? The messages can differ in many ways..</p>