How to transform values of field?

Elastic Stack Kibana
1

Hello, guys!

'doctype' field's type is String. I'd like to transform this field values like '0.0' to 'content', '1.0' to 'reply'. I checked 'Setting > Indices' controls button.

There is no option to work for me.
Somebody knows answer. plz reply me!
Thanks!

2

For something like that, you'll need to make a scripted field instead of using formatters. What version of Kibana/Elasticsearch are you using?

1 Like
3

HI, lukas. thanks for your reply.
I am using 4.5.1 Kibana.
Would you show how to make a scripted field for this situation?
I'm beginner. I don't know typing a right code about scripted field.

  • I saw other issue related this. Kibana 4.5.1 isn't work for String type. so should I change the type of 'doctype' field to Number for solving this issue?
4

How are you sending data to ElasticSearch?

5

I do sending data by Elasticsearch's Mapping rule. Mapping is okay.
I'm not sure if I understand what you say.

6

if you process your data with Logstash before sending to ElasticSearch, you can do a conditional statement for what you want.

1 Like
7

txisme, Would you show me some demo? I wanna detail for that.

8

Logstash is a pipeline that processes your files and sends them to elastic search.
https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

For example, if you have a CSV file with that you want to send, you can parse it and send it with the map you want.
Here is some example of code you can use:

if([column1] == "0.0){
     column1 => "content"
}
if([column1] == "1.0){
        column1 => "reply"
  }

I'm not sure you can change the value like that. But if not, you can perfectly add a new filed to the data with the string you want.

Check the reference guide for better understanding.

1 Like