Manual inject columns in table view

Elastic Stack Kibana
9

I'm using this now and it works great. I did have to make sure the scripted field was of type string and that the eventid number comparison is between " " because it is also of type string.

def eventid = doc['winlog.event_id'].value;
if (eventid == "7036"){
    return "A service changed state"
} 
return null
1 Like