Changing multiple fields formats in kibana

Elastic Stack Kibana
1

Hi
I'm using kibana 5.0.0
i have a lot of metricbeat fields which are bytes or percentages
so far i had to go through each field individualy and change thier format manuly (the way they would look in kibana)

this is pretty exhausting and seem like too much work - i have a lot of different index patterns

is there a way to do that before the data comes to elastic\kibana
or to change format of multiple fields at once with kibana?

Thanks

2

Hi there, have you taken a look at Logstash? You can configure Metricbeat to send data to Logstash, which can process your data and send it on to Elasticsearch. Here are the docs:

Let me know if this helps!

Thanks,
CJ

1 Like
3

Hi
thanks for your reply :slight_smile:
we have logstash but i dont see how it is related to what i wrote

4

Hey, sorry about that! To answer your question more directly, you can use Logstash to change your Metricbeat data to the desired format before it comes to Elasticsearch/Kibana. This way you won't have to go through each field individually and change the format manually.

Hope this helps!

Thanks,
CJ

5

Hi thanks for your reply
but I couldn't find how to do this with logstash
changing formats to bytes/ percentages

6

@gilisade I'm not sure if I exactly understood what you want, but let me try.
You send the data from metricbeat to logstash and then index into indices that are not matching the metricbeat-* index pattern and thus the kibana format for those fields in not defined, correct?

The question is basically how can you batch edit field format's in kibana without editing each field, correct?

Unfortunately, there is no API to do so, but you could edit the JSON that hold the definition of your index pattern in the .kibana index.
E.g. export it using Management -> Saved objects -> Export everything. Then adjust the fieldFormatMap of the document that holds the index pattern you are using, then import it again.
You could also just update that document in Elasticsearch, if you are familiar with that.

7

Yes you understood that correctly
i used your advice but i updated the documents in elasticsearch directly
and that worked perfectly
we do not use the metricbeat-* pattern so i created a scripts with the correct formats of the fields (bytes\pct) and the script changes the title and id of the index-pattern accordingly , that way every index-pattern (with metricbeat fields in it ) automatically consists the right formats

Thank you !

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.