Dynamically add new field to visualization

[Igal_Karlinsky]

Hi,

I wonder, is there a way to add new field to existing visualization dynamically?

Suppose I post CPU usage data per process like this:

1. { "date" : "00:00:10" , "CPU" : {"chrome" : 30 , "outlook" : 30 , "other" : 40}}
2. { "date" : "00:00:20" ,"CPU" : {"Firefox" : 90 , "other" : 10}}

I don't have a problem adding new mappings on the fly but is there a way to display all existing processes over time without changing the visualization?

[stevedearl (Steve Earl)]

Hi Igal,

If I've understood your question correctly then I use Timelion to achieve what you're looking for. I'm not sure if its possible with any of the other Kibana visualizations, but there are lots of people on here who know more than me so I'm sure you'll get an answer....!!

Below is an example of my Timelion visualization which is creating a series for each of the possible values within a particular ES field:

The dynamic labelling uses the fact that Timelion allows Regex (including capture groups) to auto-generate labels from your data. I'll be totally honest here - I grabbed this from another forum post - see https://discuss.elastic.co/t/timelion-how-generate-label-dynamically/85072

I suspect the above link should tell you what you need to know to get this working in Timelion.

Hope that helps,
Steve

[rashmi (kulkarni)]

The answer above by Steve is talking about terms/values in a Field but not a new field.
Kibana can't add a new field dynamically. It needs to be done programmatically as of now . Most recent versions of Kibana come with API where you can export your visualization JSON - modify it according to your needs and reimport it. But again, this wouldn't be dynamic in nature.

Thanks
Rashmi

[Igal_Karlinsky]

@rashmi @stevedearl - thanks for your input. I'll try Timelion.

[stevedearl (Steve Earl)]

Hi Rashmi - good point, I may have misunderstood Igal's initial question.