How to list the array type field

[Eric_Yin (Eric Yin Z)]

Dear ELK developers,

It seems that we cannot list the array type field based on the data table of visualization. It Only can show the max, sum, count value which is not the raw array value.

There are some requirements to calculate the sum of the array but we don't want to aggregate the array internally. We expect the aggregated result can be also the array type and the element of array can be aggregated? can add this aggregated feature?

[LeeDr (Lee Drengenberg)]

Hi Eric,

Could you please add a sample of the type of data you are using and how you would like to use it? There may be a way we can help you now or we can create an enhancement request issue.

Thanks,
Lee

[Eric_Yin (Eric Yin Z)]

Thanks for your reply. Here below is one of the sample data. I just want to list one array type field. In the kibana visualization, there is no item to show the content of array field.

I want to show this record( EUtranCellFDD.pmPrbUtilUlDistr":[898,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]) but kibana just provide max/count/avg operations for the array.

{"time":"2018-02-19 10:15","object":"SubNetwork=ONRM_ROOT_MO_R,SubNetwork=ENB_CHANGI,MeContext=ENB_733927_SATS_Inflights_Catering_Centre_1_SICC1,msrbs_ManagedElement=ENB_733927_SATS_Inflights_Catering_Centre_1_SICC1,msrbs_ENodeBFunction=1,msrbs_EUtranCellFDD=7339278","nodename":"ENB_733927_SATS_Inflights_Catering_Centre_1_SICC1","nodetype":"MSRBS","nwid":"stlsg","ropfilename":"MSRBS_2018-02-19-18:15:00_ENB_733927_SATS_Inflights_Catering_Centre_1_SICC1","cellname":"7339278","EUtranCellFDD.pmMimoSleepTime":"0","EUtranCellFDD.pmPucchCqiResLongUtilCell":"0","EUtranCellFDD.pmRadioUeRepCqiSubband1Sum":"2088","EUtranCellFDD.pmTtiBundlingUeMax":"0","EUtranCellFDD.pmRlcPollRetxDl":"305","EUtranCellFDD.pmUeCtxtRelCsfbCdma1xRtt":"0","EUtranCellFDD.pmPrbUtilUlDistr":[898,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"EUtranCellFDD.pmRlcPollRetxUl":"138","EUtranCellFDD.pmErabRelNormalEnbActArp":[0,0,0,3],"EUtranCellFDD.pmErabRelNormalEnbArp":[0,0,0,23,0,2],"EUtranCellFDD.pmRadioUeRepCqi2Subband1Sum":"2933","EUtranCellFDD.pmCellDownLockAuto":"0","EUtranCellFDD.pmRadioRecInterferencePwrPrb5":"4589506","EUtranCellFDD.pmRadioRecInterferencePwrPrb4":"3096742","EUtranCellFDD.pmRadioRecInterferencePwrPrb3":"1711150","EUtranCellFDD.pmRadioRecInterferencePwrPrb2":"4201523","EUtranCellFDD.pmRadioRecInterferencePwrPrb1":"7005382","EUtranCellFDD.pmRadioUeRepCqiSubband7Sum":"0","EUtranCellFDD.pmRadioRecInterferencePwrPrb9":"1649213","EUtranCellFDD.pmRadioRecInterferencePwrPrb8":"1392616","EUtranCellFDD.pmRadioRecInterferencePwrPrb7":"6562856","EUtranCellFDD.pmRadioRecInterferencePwrPrb6":"1546259","EUtranCellFDD.pmMacHarqDlNack16qam":"34","EUtranCellFDD.pmRrcConnReestSuccHo":"1","EUtranCellFDD.pmRrcConnEstabAttReattMos":"0","EUtranCellFDD.pmPucchCqiResMediumUtilCell":"0","EUtranCellFDD.pmPucchCqiResShortUtilCell":"1","EUtranCellFDD.pmPdcchCceAggregationDistr":[5162,1586,2944,122380],"EUtranCellFDD.pmLcgThpVolUlLcg":[0,37,784,0],"EUtranCellFDD.pmAnrNeighbrelAdd":"0","EUtranCellFDD.pmAdjustAccessDynLoadCtrlDistr":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"EUtranCellFDD.pmErabRelAbnormalEnbActTnFail":"0","EUtranCellFDD.pmFlexPdcpVolDlDrbLastTTIUe":[0,0,0],"EUtranCellFDD.pmRrcConnEstabAttReattMod":"0","EUtranCellFDD.pmPdcpPktDiscDlPelrUuQci":[0,3,0,0,0,0,0,0,0,107],"EUtranCellFDD.pmErabRelMmeActUserInactivity":"0","EUtranCellFDD.pmMacHarqDlNackQpsk":"1310","EUtranCellFDD.pmErabRelNormalEnbQci":[0,0,0,0,0,2,0,0,0,23],"EUtranCellFDD.pmCaCapableDlSum":[24,34,39,3,0],"EUtranCellFDD.pmUeThpTimeUl":"7327","EUtranCellFDD.pmRrcConnReconfSuccNoMobDlComp":"0","EUtranCellFDD.pmRrcConnEstabSuccMos":"20","EUtranCellFDD.pmUeCtxtRelAbnormalMmeAct":"0","EUtranCellFDD.pmPdcpBitrateUlDrbMax":"267","EUtranCellFDD.pmErabRelNormalEnbAct":"3","EUtranCellFDD.pmSchedActivityCellUl":"14454","EUtranCellFDD.pmMacHarqDlDtx16qam":"173","EUtranCellFDD.pmMeasRep":"524","EUtranCellFDD.pmPrbUsedDlSrbFirstTrans":"19059","EUtranCellFDD.pmRrcConnEstabSuccMod":"18","EUtranCellFDD.pmFlexErabEstabAttAddedGbr":[0,0,0]}}

[LeeDr (Lee Drengenberg)]

I created this data by posted this in the Dev Tools > Console;

POST discuss/test
{
  "array":[0,1,2,3]
}
POST discuss/test
{
  "array":[0,3,2,9]
}

Then I created an index pattern for that data.

Discover shows this data;

I can create a Data Table visualization that shows the count of each of the values like this;

If I change the default Count metric to Sum of the array I get this. It took me a while to figure out what it was showing. For each row of the array, its showing the total sum of the arrays that contain that number. So 0 is in both arrays so it's showing the sum of both arrays. 9 is only in one array and the sum in that array is 14.

I found an interesting article here; https://www.compose.com/articles/how-to-script-painless-ly-in-elasticsearch/

That shows that you can create a scripted field that can do things with the values in an array.

So I copied some code from that doc for Painless Loops and just changed the name of the field to create this scripted field for the index;

Now in Discover we see that scripted field array_sum has the sum of the array, which you could then use in visualizations instead of trying to use the array itself;

[Eric_Yin (Eric Yin Z)]

Hello Dr Lee,

Thanks for your detail explaination.
What I want to get from kiban visualization is
array 1: [0,1,2,3]
array 2: [0,3,2,9]

in visualization table, I would like to get this result:
total: [0,4,4,12]

means array1 + array2:
[0+0,1+3,2+2,3+9]

I would get the aggregated array type result instead of getting sum of each element of the array.
I guess painless can calculate each element and can return the array type result but it seems that kibana visualization table cannot shows the array type result.
I am not sure if it is poosible to add the item like "array element sum" for this kinds of caculation.

[LeeDr (Lee Drengenberg)]

Painless scripted fields don't have an array type to return. You could probably return a string data type that looks like that array. But that might not suit your needs.