Change column name in saved query


I want to show in my dashboard a saved query (like the picture i pasted in this message).
I have created this saved query in "discover"
My question, is it possible to change the column name (in yellow) with a label I will choose.
For exemple change event_data.SubjectUserName to User.

I know it is possible when i create some visualize, but i don't know if it is possible in my case.

Thank you for your response.

hey @yde,

that isn't possible when you create a table from a saved search in Discover.

Maybe that's what you meant, but you can always recreate the saved-search with the Data Table visualization and then rename the column there.

Otherwise, I'd open a feature request here:


Hi thank you for your answer, this is what I wanted.

So is it possible to make a Data Table Visualization without aggregation (count) ?
In my Data Table Idon't want any aggregation only show data.
That is why I ask my question.


hi @yde, yes, you can do that in a DataTable visualization, if you have an id-field that uniquely identifies a document. Then, you can do a terms-aggregation on that field as your top-level bucket-aggregation. That gives you back a table, which each row corresponding to a single document.

You can then select other terms or values you want to see in your subbuckets and/or metrics.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.