Kibana Visualization Column Name

Elastic Stack Kibana
1

Hi,
I wish to edit column names in saved search in kibana 6.2.2. I tried creating a data table visualization but there i am getting count as a default column which is not needed as per my requirements. Is it possible to edit column names in saved search?

2

Is it possible to edit column names in saved search?

Not directly, but you can fake it with a scripted field. In Management > Index Patterns, click the Scripted Fields tab and add a new field. Name the field whatever you would like it to look like, then in the value of the script use:

doc['some_field'].value

Where some_field is the existing name of the field. This will effectively just "proxy" that value into a new field with the name you want to use. Then you can use that scripted field in your existing saved search, just edit it and save.

1 Like
3

I tried with this but after doing the settings i am unable to get my data in discover.

4

i am unable to get my data in discover

Are you getting errors or something? What do you mean you're unable to get your data?

5

Yes, I am not getting any data in the data table. Earlier I got the required data along with count but when I made the changes given by you, no data is being displayed in the table. Can you provide me a solution for the same.

Thank you.

6

Do you see any errors, either in the browser, or in the output from the Kibana server? And if you remove the scripted field, does your data show up again in Discover? Perhaps there's a syntax error in the scripted field definition...

7

Yes on removing the scripted fields i am getting all the data.I had used doc['field_name'].value this definition for creating the scripted field.
Also i wish to change the field names only on the discover tab how can i get that?

8

Maybe this is a silly question, but you're placing field_name with the name of the field you are trying to rename, right?

Also i wish to change the field names only on the discover tab how can i get that?

The scripted field will make the new name available in visualizations and all over, there's no way around that. It's just part of the index pattern, and is automatically available.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.