diff --git a/src/platform/packages/shared/kbn-esql-utils/src/utils/query_parsing_helpers.ts b/src/platform/packages/shared/kbn-esql-utils/src/utils/query_parsing_helpers.ts
index db2ddb9a40c4..003d3431c026 100644
--- a/src/platform/packages/shared/kbn-esql-utils/src/utils/query_parsing_helpers.ts
+++ b/src/platform/packages/shared/kbn-esql-utils/src/utils/query_parsing_helpers.ts
@@ -369,47 +369,17 @@ export const getArgsFromRenameFunction = (
  */
 export const getCategorizeField = (esql: string): string[] => {
   const { root } = parse(esql);
-  const statsCommand = root.commands.find(({ name }) => name === 'stats');
-  if (!statsCommand) {
-    return [];
-  }
-  const options: ESQLCommandOption[] = [];
   const columns: string[] = [];
-
-  walk(statsCommand, {
-    visitCommandOption: (node) => options.push(node),
-  });
-
-  const statsByOptions = options.find(({ name }) => name === 'by');
-
-  // categorize is part of the stats by command
-  if (!statsByOptions) {
-    return [];
-  }
-
-  const categorizeOptions = statsByOptions.args.filter((arg) => {
-    return (arg as ESQLFunction).text.toLowerCase().indexOf('categorize') !== -1;
+  const functions = Walker.matchAll(root.commands, {
+    type: 'function',
+    name: 'categorize',
   }) as ESQLFunction[];
 
-  if (categorizeOptions.length) {
-    categorizeOptions.forEach((arg) => {
-      // ... STATS ... BY CATEGORIZE(field)
-      if (isFunctionExpression(arg) && arg.name === 'categorize') {
-        walk(arg, {
-          visitColumn: (node) => columns.push(node.name),
-        });
-      } else {
-        // ... STATS ... BY pattern = CATEGORIZE(field)
-        walk(arg, {
-          visitFunction: (node) => {
-            if (node.name === 'categorize') {
-              const columnArgs = node.args.filter((a) => isColumn(a));
-              columnArgs.forEach((c) => columns.push((c as ESQLColumn).name));
-            }
-          },
-        });
-      }
+  if (functions.length) {
+    functions.forEach((func) => {
+      for (const arg of func.args) if (isColumn(arg)) columns.push(arg.name);
     });
+    return columns;
   }
 
   return columns;