How to edit the legends in kibana?


(pramod choudhari) #1

I want to edit the names of legends in the following visualization.
this is how my visualization looks like.

This is how my Filter looks :-

filter {
  if [fields][log_type] == "syslog" {
    grok {
      match => { "message" => "(#!TOT:)?320:%{NUMBER:q}:%{NUMBER:q1}:%{NUMBER:q2}:%{NUMBER:q3}:%{NUMBER:q4}:%{NUMBER:q5}:%{NUMBER:st2} %{NUMBER:st3} %{NUMBER:st4} %{NUMBER:st5} %{NUMBER:st6} %{NUMBER:st7} %{NUMBER:st8} %{NUMBER:st9} %{NUMBER:st10} %{NUMBER:st11} %{NUMBER:st12} %{NUMBER:st13} %{NUMBER:st14} %{NUMBER:st15} %{NUMBER:st16} %{NUMBER:st17} %{NUMBER:st18} %{NUMBER:st19} %{NUMBER:st20} %{NUMBER:st21} %{NUMBER:st22} %{NUMBER:st23} %{NUMBER:st24} %{NUMBER:st25} %{NUMBER:st26} %{NUMBER:st27} %{NUMBER:st28} %{NUMBER:st29} :" }
      match => { "message" => "(#!TOT:)?83:%{NUMBER:r}:%{NUMBER:r1}:%{NUMBER:r2}:%{NUMBER:r3}:%{NUMBER:r4}:%{NUMBER:r5}:%{NUMBER:en2} %{NUMBER:en3} %{NUMBER:en4} %{NUMBER:en5} %{NUMBER:en6} %{NUMBER:en7} %{NUMBER:en8} %{NUMBER:en9} %{NUMBER:en10} %{NUMBER:en11} :" }
    }
    grok{
       match => { "source" => "%{UNIXPATH}/%{YEAR:yr}%{MONTHNUM:mn}%{MONTHDAY:md}.%{HOUR:hr}%{MINUTE:min}.min"}
    }
  }
  if ("_grokparsefailure" in [tags]) { drop {} }
  else {
    mutate {
      remove_field => ["[q]","[q1]","[q2]","[q3]","[q4]","[st1]","[st3]",["st4"],"[st5]","[st6]","[st7]","[st8]","[st9]","[st10]","[st11]","[st12]","[st14]","[st15]","[st17]","[st18]","[st19]","[st20]","[st21]","[st22]","[st23]","[st24]","[st25]","[st26]","[st28]","[st29]","[r]","[r2]","[r3]","[r4]","[en2]","[en3]","[en5]","[en6]","[en7]","[en8]","[en9]","[en10]","[en11]"]
      convert => {
        "r1" => "integer"
        "en4" => "integer"
        "st2" => "integer"
        "st16" => "integer"
        "st13" => "integer"
        "st27" => "integer"
      }
      add_field => { "creationTime" => "%{yr}%{mn}%{md} %{hr}:%{min}"  }
      remove_field => [ "[yr]","[mn]","[md]","[hr]","[min]" ]
    }
  }
}

the value r1 is what being displayed as legend in the visualization.
can somebody please suggest any addition in my code to rename this legends maybe to 'a','b','c'..... and display it onto kibana?
Please Help!!!!


(Tyler Smalley) #2

I assume that r1 represents the load? So are you wanting to translate the load integer back to some sort of string?


(pramod choudhari) #3

No .peak load is represented by en4 and is plotted on y-axis.

Actually r1 is used to differentiate host names so can you please help me so that I can change those r1 to some host names
Those values 0,-1,1,20,40..... are values of r1 I want them to be changed to some string like this
0 ----------> hosta
20 ---------> hostb
-1 ----------> hostc
@tylersmalley can you please help!


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.