Building Pie chart in kibana

Hi,

I have tried build pie chart on field such as "STAT" and "Sender_", but some logs contain only the "STAT" field and some logs contain "Sender_id". I tried building viz on two parameters but it's not working through the "ID" field is common between three "docs".

Is there any work around in building pie chart based on below logs for fields such as "STAT" and "Sender_id"

logs-

	Time	                              ID                             STAT         Sender_id
	Nov 17, 2021 @ 22:46:58.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	REJECTD	          - 
	Nov 17, 2021 @ 22:47:02.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	DELIVRD	          -   
	Nov 17, 2021 @ 22:46:55.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	 - 	               ABC

Snap-

Pie chart config snap-

Thank you!!!!

Hi there, I am afraid it's not possible at the moment.

Hi @Marta_Bondyra,
Thanks for confirmation

I am using logstash for parsing logs,I checked if I can fill the "Sender_id" field using logstash filters or using scripted fields in kibana, but I am still checking more on it.

If you can throw some light on it, would be helpful.

If you cannot update the loading of the data, perhaps you could create an additional runtime field (the newer version of scripted fields) for each of those that either emits the actual value or some other value like "MISSING" when the value does not exist.

Also I would try the part chart in lens you might find it a little more flexible / easier

Hi @stephenb,
Thanks for the reply

I checked with scripted fields but did not get desired results.

Script-

if (doc.containsKey('MSGID.keyword') && !doc['Sender_id.keyword'].empty) 
    return params['_source']['Sender_id'];

else if (doc.containsKey('MSGID.keyword') && !doc['STAT.keyword'].empty) 
    return params['_source']['STAT'];

Results are-

Time	                              ID                             STAT         Sender_id     Scripted_Field
	Nov 17, 2021 @ 22:46:58.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	REJECTD	          -   REJECTD
	Nov 17, 2021 @ 22:47:02.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8    DELIVRD	          -   DELIVRD   
	Nov 17, 2021 @ 22:46:55.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	 - 	           ABC       ABC

In this index, there are two types of logs, one log which contains "Sender_id" and the other log contains "STAT" field. I want to create a new field that will contain the "Sender_id" field in all logs.

"MSGID" field is the same for both types of logs.

Expected Result-

Time	                              ID                             STAT         Sender_id    Scripted_Field
	Nov 17, 2021 @ 22:46:58.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	REJECTD	          -   ABC
	Nov 17, 2021 @ 22:47:02.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8    DELIVRD	          -   ABC   
	Nov 17, 2021 @ 22:46:55.000	5a77cf94-e635-4aeb-9ae7-0e9ad37976a8	 - 	           ABC       ABC

Actually, I need to compare "MSGID" fields of different logs and If it matches then "Sender_id" should get printed for all common "MSGID" logs that do not have the "Sender_id" field.

Thanks for the explanation.

Now that I see what you want to accomplish that is not possible at this time, you can not read fields from another record with runtime or scripted fields at this time.

The normal way to do this would be on ingest, perhaps if you had a source of the IDs with the Senders you could use an enrich processor.