Static lookup

[IsAa]

Hi ELK Users,

I was working on static look up table on index pattern.

As you can observe that, I have two keys which I am mapping to the same value

I can see in the Discover section, that these values are getting re-named

But when building visualization using term aggregation,

I see the two value fields in the visualization

Is there a bug here, or my implementation for the static look-up table is not correct?

Basically, I was hoping that after using a new value for the key, they would have been aggregated together under the same term.

What would be a good approach to aggregate keys and their values together?

Kind regards.

[Marta_Bondyra]

Hi there, what version of Kibana are you on? Depends on that you could either use scripted fields or runtime fields.

For scripted fields, go to Stack management and Index Patterns and add a scripted field according to this scheme (replace field_name in this script):

if(doc['field_name'].size()== 0) return null;

if (doc['field_name'].value == 'Resolutions')
    return "Meetings";
return doc['field_name'].value;

Then use your scripted field in your visualization instead of your original field.

[Marta_Bondyra]

For kibana v7.11 or later, use runtime field instead.
Steps to do it:

1. Open lens or discover.

2. In Lens, click on the button close to the index pattern switcher:
   

3. Write your script (example with category.keyword):
   

   

String m = doc["category.keyword"].value;
if (doc['category.keyword'].value == "Men's Clothing")
    m = "Women's Clothing";
emit(m)

And use it in your visualization, here I merged men's clothing with women's clothing.

[IsAa]

Hi,

I am on elastic cloud instance, and the version is 7.12.1.

I tried giving lens a go. But I don't see this index pattern switcher either in lens or discover

But the scripting approach is working for me

Hmm !

Thanks

[ghudgins (Graham Hudgins)]

Ah, the UI in lens/discover was added in 7.13.0

You can write scripted runtime fields from Stack Management in the Index Pattern any time after 7.11. Once you have your field, it'll show up as a normal field in your list in discover & lens