Error in Vega: Invalid field predicate

Elastic Stack Kibana
1

Hi,

I was not able to filter out invalid / zero data for a field in vega. Please help!!

I tried using:
{"filter": {"field": "MAX", "valid": true}}
or
{"filter": {"field": "MAX", "gt": 0}}

I also tried using the filed before renaming:
{"filter": {"field": "datum._source['check_result.perfdata.swap.max']", "valid": true}}
or
{"filter": {"field": "datum._source['check_result.perfdata.swap.max']", "gt": 0}}

Still having same error... Please advise what's wrong.

{
  $schema: https://vega.github.io/schema/vega-lite/v2.json
  data: {
    url: {
      "%timefield%": "@timestamp"
      index: icinga2-*
      body: {
        size: 10000
        _source: ["@timestamp", "check_result.perfdata.swap.value", "check_result.perfdata.swap.max", "check_command", "host"]
      }
    }
    format: {property: "hits.hits"}
  }
  transform: [
        { calculate: "datum._source['check_result.perfdata.swap.value']/1000000000" as: "USED"},
        { calculate: "datum._source['check_result.perfdata.swap.max']/1000000000" as: "MAX"},
        { calculate: "datum._source['host']" as: "host"},
        { calculate: "datum._source['check_command']" as: "check_command"},
        { calculate: "datum._source['@timestamp']" as: "timestamp"},
        {"filter": {"field": "MAX", "valid": true}}
    ],
      "layer": [
    {
      "selection": {
        "grid": {"type": "interval", "bind": "scales" }
      },
      "mark": "area",
  "encoding": {
    "x": {
      "field": "timestamp", "type": "temporal"
    },
    "y": {
     "field": "MAX","type": "quantitative",
    },
    "color": {"value": "brown"}
  }
  }
  ]
}

Error:

Invalid field predicate: {"field":"MAX","valid":true}

2

The latest version of Vega-Lite used by Kibana is v2.4.0. The valid field predicate is not supported in Vega-Lite v2.4.0 and earlier. You'll want to use a Vega expression instead. Maybe something like this.

{ filter: "datum.MAX > 0" }
1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.