Display another field as the result of a Lens formula

Elastic Stack Kibana
1

Hello,

Assume an index which contains entries with a version field, something like:

"version": {
  "properties": {
    "id": {
      "type": "keyword"
    },
    "major": {
      "type": "keyword"
    },
    "minor": {
      "type": "keyword"
    },
    "number": {
      "type": "long"
    }
  }

In a table I would like to show for the current aggregation the "lowest" version. To do that I've created that "number" field that's a padded format of the version.

For instance version "1.3.12" is "10312" and 2.23.1 is "22301". This way I can easily apply a min(version.number).

However, I want to display the version.text as the result, not version.number.

How do I do that?

2

Bonjour Stéphane :wink:

I don't think you can do that in a Lens data table, ie when aggregating data with a min metric. Because the min metric implies a calculation of a numerical value and not a "give me the document where x is the min of the dataset".

I was trying this morning to POC around ES|QL to see if we have a solution for this and for now the INLINE STATS feature is not available. There will be some new features in ES|QL that would allow such computations.

But while digging around this, I found that ES|QL has now support to TO_VERSION which is super handy IMO in your case.

Have a look at:

DELETE test 
PUT test
{
  "mappings": {
    "properties": {
      "version": {
        "type": "keyword"
      }
    }
  }
}
PUT test/_doc/1
{
  "version": "1.12.3"
}
PUT test/_doc/2
{
  "version": "2.23.4"
}

You can run something like:

FROM test 
| EVAL v = TO_VERSION(version)
| STATS min = MIN(v)
| LIMIT 10

Which gives you:

image
image1866×1060 92.1 KB

Not sure it helps, but that's an idea :wink:

1 Like