I want to edit the names of legends in the following visualization.
this is how my visualization looks like.
This is how my Filter looks :-
filter {
if [fields][log_type] == "syslog" {
grok {
match => { "message" => "(#!TOT:)?320:%{NUMBER:q}:%{NUMBER:q1}:%{NUMBER:q2}:%{NUMBER:q3}:%{NUMBER:q4}:%{NUMBER:q5}:%{NUMBER:st2} %{NUMBER:st3} %{NUMBER:st4} %{NUMBER:st5} %{NUMBER:st6} %{NUMBER:st7} %{NUMBER:st8} %{NUMBER:st9} %{NUMBER:st10} %{NUMBER:st11} %{NUMBER:st12} %{NUMBER:st13} %{NUMBER:st14} %{NUMBER:st15} %{NUMBER:st16} %{NUMBER:st17} %{NUMBER:st18} %{NUMBER:st19} %{NUMBER:st20} %{NUMBER:st21} %{NUMBER:st22} %{NUMBER:st23} %{NUMBER:st24} %{NUMBER:st25} %{NUMBER:st26} %{NUMBER:st27} %{NUMBER:st28} %{NUMBER:st29} :" }
match => { "message" => "(#!TOT:)?83:%{NUMBER:r}:%{NUMBER:r1}:%{NUMBER:r2}:%{NUMBER:r3}:%{NUMBER:r4}:%{NUMBER:r5}:%{NUMBER:en2} %{NUMBER:en3} %{NUMBER:en4} %{NUMBER:en5} %{NUMBER:en6} %{NUMBER:en7} %{NUMBER:en8} %{NUMBER:en9} %{NUMBER:en10} %{NUMBER:en11} :" }
}
grok{
match => { "source" => "%{UNIXPATH}/%{YEAR:yr}%{MONTHNUM:mn}%{MONTHDAY:md}.%{HOUR:hr}%{MINUTE:min}.min"}
}
}
if ("_grokparsefailure" in [tags]) { drop {} }
else {
mutate {
remove_field => ["[q]","[q1]","[q2]","[q3]","[q4]","[st1]","[st3]",["st4"],"[st5]","[st6]","[st7]","[st8]","[st9]","[st10]","[st11]","[st12]","[st14]","[st15]","[st17]","[st18]","[st19]","[st20]","[st21]","[st22]","[st23]","[st24]","[st25]","[st26]","[st28]","[st29]","[r]","[r2]","[r3]","[r4]","[en2]","[en3]","[en5]","[en6]","[en7]","[en8]","[en9]","[en10]","[en11]"]
convert => {
"r1" => "integer"
"en4" => "integer"
"st2" => "integer"
"st16" => "integer"
"st13" => "integer"
"st27" => "integer"
}
add_field => { "creationTime" => "%{yr}%{mn}%{md} %{hr}:%{min}" }
remove_field => [ "[yr]","[mn]","[md]","[hr]","[min]" ]
}
}
}
the value r1 is what being displayed as legend in the visualization.
can somebody please suggest any addition in my code to rename this legends maybe to 'a','b','c'..... and display it onto kibana?
Please Help!!!!