Split a field value in a Visualization

Elastic Stack Kibana
,
1

Hi everyone,

Currently I am trying to split the value of a field (an email) by the '@' in an "Aggregation Based - Data Table" visualization at Kibana, so the expected output for an email field with value name@domain.com would be:

  • field 1: name
  • field 2: domain

I have no access to filebeat, which I guess will be th eassiest way to do it, so I tried to apply a painless like substring script and a processor at Advance settings (the JSON script option within the Visualization), as expected, nothing worked.

image

It is possible to do such an split at this Kibana visualization (or another one) or I have to go to Logstash?

Thank you in advance!

2

Could you use an ingest pipeline? A dissect processor with a pattern something like %{name}@%{domain} would do the trick.

1 Like
3

Or two runtime fields depending what version you are on.

1 Like
4

Thank you both guys! I'll add this change to Logstash then :smiley:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.