Calculating a formula on nested fields in classic, aggregation-based visualizations

Elastic Stack Kibana
1

I have a document field that gives me a result in kBit/s, but I would like to convert it to MBit/s (by dividing by 1,000). This should only be done during visualization; there is no need to create a runtime field or scripted field.

For the new, lens-based visualizations, I can easily create a formula for the selected field:

image
image798×490 22.4 KB

But for the aggregation-based visualizations, how do I accomplish the same thing? I thought this would be simple, but the "JSON input" field is … uhm, not very intuitive. I thought I could adapt some scripts I found online, but this does not work, saying that the statistic_values field is missing in the mapping.

image
image628×638 40.6 KB

Isn't it there, obviously? How do I change the script to do what I want?

2

Well, okay, this was simple. For a nested field, you have to use dots to get the value:

{
  "script": {
    "inline": "doc['statistic_values.throughput'].value/1000",
    "lang": "painless"
  }
}
3

On a related note, if the data you ingest uses bytes instead of kilobytes, you can use the Field Formatters in Kibana to easily convert the number into human readable versions (like KB, MB or GB).

4

Thanks, but that does not work for aggregation-based visualizations, correct?

5

It should work pretty much everywhere in Kibana. i think the only exception is Lens or TSVB which can set their own formatting.

6

I don't really understand this though. Can I explicitly set the formatting as "Bytes"? If so, where? Or does this have to be specified as a type for a field when creating the index mapping?

7

You enable the Field Formatting for a field by going to "Stack management" -> "Data Views"/"Index Patterns" depending on what version of Kibana you're on -> select the Index pattern you're interested in -> search for the field that you want to apply a field formatter to -> there is a small crayon on the last column of the field table that allows you to edit that field and set a format.

8

This is awesome, I never discovered this feature! For others who may read this, it looks like this:

image
image1158×904 53.6 KB

The general help section on this is here: Manage data views | Kibana Guide [8.4] | Elastic

That said, it's not a direct solution for my problem, because the data ingested uses KBit/s as a unit, and I have to convert to MBit/s – so the default "Bytes" assumption does not work here.

Anyway, thanks for explaining this in detail!

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.