I'm having a timestamp field which has a value something like this , where pretty much all the values would be in the same format:
January 1st 2017, 05:29:59.000
What I need is to trim part of the above which should look:
January 1st 2017
So what I wanted to know is whether is it possible to do the above using
painless scripting within
Kibana itself? Something like assign the trimmed value to a new scripted field? I wanted to do it within
Kibana , since I just wanted to show only the shorter format of the date in the graph.
Any help would be appreciated.
There's a blog post on Painless scripted fields in Kibana here;
It has some examples using date functions.
Let me know if that doesn't help you.
You could also try splitting the date value on ", " and using the first element in the resulting array.
And here's another way to do it, using Moment.js formatting:
Thank you @LeeDr and @cjcenizal.
Wrote a scripted field as @cjcenizal suggested, using the
moment.js date formatting. But then I had to change the
0 since having it as
1 didn't allow me to access the scripted field in the graph. Making it
A small clarification, what does
Popularity represents there and how does it affect the scripted field?
Popularity just makes a field show up in the
Popular group in the Discover field list. It just makes it easier to find your favorite fields when there are very many.
Clicking Add on a field also increases it's popularity to 1. If I click add on a field like bytes_in in my example, then remove it from the doc view list by clicking the little
x next to the name at the top of the column, then it moves from the
Selected Fields list to the
In this screenshot, you see the field
direction in the
Popular list because I set it's Popularity to 10 in the Settings tab (anything greater than zero makes it appear in the list).
@LeeDr Oh that's spot on. Understood!
So it's like moving the field into the popular list, so that it makes the life easier when you're discovering the data.
Thanks again for the explanation!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.