Truncate part of an existing field value to a new field using painless?

Elastic Stack Kibana
1

I'm having a timestamp field which has a value something like this , where pretty much all the values would be in the same format:

January 1st 2017, 05:29:59.000

What I need is to trim part of the above which should look:

January 1st 2017

So what I wanted to know is whether is it possible to do the above using painless scripting within Kibana itself? Something like assign the trimmed value to a new scripted field? I wanted to do it within Kibana , since I just wanted to show only the shorter format of the date in the graph.

Any help would be appreciated.

2

There's a blog post on Painless scripted fields in Kibana here;

It has some examples using date functions.

Let me know if that doesn't help you.

Regards,
Lee

1 Like
3

You could also try splitting the date value on ", " and using the first element in the resulting array.

CJ

1 Like
4

And here's another way to do it, using Moment.js formatting:

Pasted image2292×1308 69.2 KB

1 Like
5

Thank you @LeeDr and @cjcenizal.

Wrote a scripted field as @cjcenizal suggested, using the moment.js date formatting. But then I had to change the Popularity to 0 since having it as 1 didn't allow me to access the scripted field in the graph. Making it 0 worked!

A small clarification, what does Popularity represents there and how does it affect the scripted field?

Thanks again :slight_smile:

6

Popularity just makes a field show up in the Popular group in the Discover field list. It just makes it easier to find your favorite fields when there are very many.

Clicking Add on a field also increases it's popularity to 1. If I click add on a field like bytes_in in my example, then remove it from the doc view list by clicking the little x next to the name at the top of the column, then it moves from the Selected Fields list to the Popular list.

In this screenshot, you see the field direction in the Popular list because I set it's Popularity to 10 in the Settings tab (anything greater than zero makes it appear in the list).

blob.jpg1868×598 123 KB

1 Like
7

@LeeDr Oh that's spot on. Understood! :slight_smile:

So it's like moving the field into the popular list, so that it makes the life easier when you're discovering the data.

Thanks again for the explanation!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.