Creating custom legends for Kibana visualizations

[amclaughlin (Andrew McLaughlin)]

Good afternoon everyone!

We are just getting started with our rollout of the ELK stack, and I have found, on several occasions, that it would be very beneficial for us to be able to customize the legend of a given visualization to display a custom field, rather than the simple value that the filtered field contains.

Is there a clean way to have a visualization reference a table, for instance, where it will display "Batch Logon" instead of "4"?

Thank you!

[jbudz (Jon Budzenski)]

Hmm - there's not a lot of options for references currently if I understand correctly. https://github.com/elastic/kibana/issues/12560 has some existing discussion.

I'm not sure I fully understand the context of your visualization though, can you share a little more info on what it looks like? Is the value of 4 a direct mapping to 'Batch Logon"? This could be mapped with a scripted field.

[amclaughlin (Andrew McLaughlin)]

We have a visual on a dashboard with a set of values that can be one of 9 values. It will always be one of these 9 values, and each of the nine values is always a 1 to 1 relationship with a set value, i.e. a 4 on the chart always corresponds to a Batch logon, a 9 is always a logon using a set of new credentials, etc.

I'd like to have the legend at the right be more easily grokkable for users who don't understand the relationship immediately.