Pie chart with extracting major from JRE version in Kibana

[vmassol (Vincent Massol)]

Hi there,

In my index I have documents with a java.version field representing java versions (e.g. 11.0.13, 11.0.14.1, etc). I'm trying to extract the major version (e.g. 11) and display that in a pie chart in Kibana.

What's the easiest way to do this?

I started checking script fields in Kibana and to add some to my Data View but I've found that:

• it's deprecated and runtime fields are the way forward
• I couldn't use String.split() and Create Scripted Field using substring before "." - #10 by aaron_nimocks doesn't seem to work either (or I don't know how to use it).

  String value = doc['java.version'].value;
  String[] result = /./.split(value);
  return result[0];
  

Thus I wanted to check that using a runtime field is the way to go. It seems I'll need to create the runtime field in the ES mapping or in an ES search request according to Runtime fields | Elasticsearch Guide [8.2] | Elastic. This seems a bit strange as I only need to create this runtime field for the purpose of viewing data in Kibana.

Could you confirm I'm going in the right direction? Seems complex-ish for my original need.

Thx!

[stephenb (Stephen Brown)]

Hi @vmassol

You can add a runtime field just to the index pattern / data view
Then it will only live in the index pattern / data view but will be available for Lens / Visualizations but will not be available in DSL queries etc..

Here is the code for the runtime field

def version = doc["java.version"].value;
if (version != null) {
    int firstDot = version.indexOf('.');
    if (firstDot > 0) {
        emit(version.substring(0, firstDot));
    return;
    }
}
emit("Unknown");

Go To Stack Management -> Data Views -> Choose Data View -> Add Field

Pie Chart...

[vmassol (Vincent Massol)]

This is awesome! Thanks a lot for your great answer and details