Calculating a formula on nested fields in classic, aggregation-based visualizations

[slhck (Werner Robitza)]

I have a document field that gives me a result in kBit/s, but I would like to convert it to MBit/s (by dividing by 1,000). This should only be done during visualization; there is no need to create a runtime field or scripted field.

For the new, lens-based visualizations, I can easily create a formula for the selected field:

But for the aggregation-based visualizations, how do I accomplish the same thing? I thought this would be simple, but the "JSON input" field is … uhm, not very intuitive. I thought I could adapt some scripts I found online, but this does not work, saying that the statistic_values field is missing in the mapping.

Isn't it there, obviously? How do I change the script to do what I want?

[slhck (Werner Robitza)]

Well, okay, this was simple. For a nested field, you have to use dots to get the value:

{
  "script": {
    "inline": "doc['statistic_values.throughput'].value/1000",
    "lang": "painless"
  }
}

[Marius_Dragomir]

On a related note, if the data you ingest uses bytes instead of kilobytes, you can use the Field Formatters in Kibana to easily convert the number into human readable versions (like KB, MB or GB).

Numeral Formatting | Kibana Guide [8.4] | Elastic

[slhck (Werner Robitza)]

Thanks, but that does not work for aggregation-based visualizations, correct?

[Marius_Dragomir]

It should work pretty much everywhere in Kibana. i think the only exception is Lens or TSVB which can set their own formatting.

[slhck (Werner Robitza)]

I don't really understand this though. Can I explicitly set the formatting as "Bytes"? If so, where? Or does this have to be specified as a type for a field when creating the index mapping?

[Marius_Dragomir]

You enable the Field Formatting for a field by going to "Stack management" -> "Data Views"/"Index Patterns" depending on what version of Kibana you're on -> select the Index pattern you're interested in -> search for the field that you want to apply a field formatter to -> there is a small crayon on the last column of the field table that allows you to edit that field and set a format.

[slhck (Werner Robitza)]

This is awesome, I never discovered this feature! For others who may read this, it looks like this:

The general help section on this is here: Manage data views | Kibana Guide [8.4] | Elastic

That said, it's not a direct solution for my problem, because the data ingested uses KBit/s as a unit, and I have to convert to MBit/s – so the default "Bytes" assumption does not work here.

Anyway, thanks for explaining this in detail!