Coloring Metric aggregation based on String

[Cibot]

I have been trying to create a dashboard with relevant information for a service.
As such we display logs, uptime over time, errors, current state and so on.
To make it easy to indicate whether a service is down, I want to use colors.
As such I've tried the following:

Go To Dashboard
All Types -> AGGREGATION BASED -> Metric
Metric: Top Hit
Field: system.service.state
Concatenate: 1

Now to achieve different coloring, there are OPTIONS which include coloring based on ranges.
Is there a way to color based on value?
System.service.state usually has something like 'active' or 'dead' and as such is there a way to define static coloring options?
Maybe I can achieve something similar in a different way?
I don't exactly know how the ranges here are exactly calculated but I always end up with red.

[matw (Matthias Wilhelm)]

Hi and welcome to our community

This is currently just possible using Vega in Kibana, and also I can't find a simple solution for this, you need to dig into Vega documentation.

Condition

There might another work around using runtime fields

Runtime fields | Elasticsearch Guide [master] | Elastic

You could create a runtime field mapping strings to emojis, this need field you can use in your metric aggregation, and this way you can add some color to your metric ... it's not exactly what you're a looking for, but just wanted to highlight that this is possible:

Runtime fields | Elasticsearch Guide [master] | Elastic

Best,
Matthias

[matw (Matthias Wilhelm)]

go another info for you. you can use the color field formatter for your task, it should work like this:

Hope this helps

[Cibot]

Thanks for the replies.
I tried to get into VEGA but I think I would need another month to fully understand everything there so that's not an option

The second option I've already seen in some other post so that was my backup solution, but still thanks for pointing it out.
It certainly is a solution but obviously not as neat / clean as the coloring mechanism in the metric itself, since it is much much smaller.
It will still suffice for now though. Maybe separating each field based on the service will make this look better. Since I currently have 18 services in one block, I will have to create 18 separate blocks to check whether this looks better. Thank you anyway.