0

I have a field that varies 1,2,3. I'd like to have the visualization show red, blue, green instead of the int (i.e. int to string). Is this possible to do without redoing the index?

For example, I have a bar chart with 1,2,3 on the horizontal axis. I would like it to change to: red, blue, green.

I spent an hour googling for answers to this question, did not find any. Read through the kibana documentation and did not see this there either. It seems that it might be impossible, given what I've read about string to int operations. It should be really easy so I'm just trying to figure out the proper way to do this.

michael-c-michael
  • 1

1 Answers1

0

Yes, if you are on 7.13-7.17, you can do this with scripted fields when defining your index pattern (or data view depending on which version your are).

7.x

Simply go to Stack Management > Index Patterns (or Stack Management > Data views), select your index and then add a new scripted field (type: string, format: string) and add the following Painless script:

def colors = ['1': 'red', '2': 'blue', '3': 'green'];
return doc.color.size() > 0 ? colors[doc.color.value.toString()] : null;

On Kibana 7.17, it looks like this:

test script field

Then in your bar chart visualization, you can use this new stringified color script field in your terms aggregation instead of the integer field:

bar chart

8.x

If you are on 8.x, you can achieve the same with runtime fields.

You can go to Stack Management > Data Views and click "Add field". Then you can give your field a name and select the "keyword" type. Select "Set Value" and add the following script inside the text field:

def colors = ['1': 'red', '2': 'blue', '3': 'green'];
emit(doc.color.size() > 0 ? colors[doc.color.value.toString()] : null);

Then proceed the same way when creating your bar chart visualization by selecting this new runtime field instead of the integer one.

Val
  • 207,596
  • 13
  • 358
  • 360