Timelion dynamic lable by q=type

Elastic Stack Kibana
1

Hey so I am trying to do a count over time with timelion based on a q= search, I cannot post screenshots but ill do my best show what I'm trying to do with fruits as an alias.

my search looks like:
es.(kibana=true, q=Foods:Fruit, split=Fruit_name:10).
when I do this the data displays correctly but the labels in the legend show up as;
q:Foods:Fruit>Fruit_name:"Apples">count
q:Foods:Fruit>Fruit_name:"Oranges">count
q:Foods:Fruit>Fruit_name:"Bananas">count

I would really love if there was a way to get labels to just be:
Apples
Oranges
Bananas

is there a modifier for .label() that i don't know about or would I have to use some Regex ?

2

You should be able to do something like this

.es(kibana=true, q=Foods:Fruit, split=Fruit_name:10).label('$1', regex='.*>Fruit_name:"(.*)">.*')
3

Thanks, follow up question. the names I was trying to parse contained ":" and a space would this affect the functionality. For example if the line was:
q:Foods:Fruit>Fruit_name:"Apples: Honeycrisp">count

4

I think the regex I provided should still work fine in that case.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.