Field change value

Elastic Stack Kibana
1

I want to change the value of the field user.id , so that it only shows the username. In this example, I want to remove the "slu" so that the value only shows "AlbissR" and not "slu\AlbissR"

4kSfM

2

You can do a scripted field. Something like the below. Just need to replace params.name with your field doc['some_field'].value in both places. (I did my testing in Painless Lab).

This will split the string if it contains an \ and then returns everything after an \. If it doesn't contain an \ then it returns original value.

String[] parts = /\\/.split(params.name);

if(parts.length > 1)
{
    return parts[1];
} else {
    return params.name;
}

** I would recommend doing this on ingest with an ingest processor if you are able to.

3

I tried that and I got following error:

[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max_compilations_rate] setting
4

I've never hit that error before or really understand the reason. But here is a blog post to work through that error.

If you can't work through that I'd open a new thread for that specific error and someone who has seen those can help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.