# Truncate part of an existing field value to a new field using painless?

**URL:** https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350
**Category:** Kibana
**Created:** [January 2, 2017, 10:35am UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350 "2017-01-02T10:35:28Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Kulasangar\_Gowrisang](https://avatars.discourse-cdn.com/v4/letter/k/ce73a5/32.png) [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)
#### Post date: [January 2, 2017, 10:35am UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/1 "2017-01-02T10:35:28Z")

</div>

I'm having a timestamp field which has a value something like this , where pretty much all the values would be in the same format:

`January 1st 2017, 05:29:59.000`

What I need is to trim part of the above which should look:

`January 1st 2017`

So what I wanted to know is whether is it possible to do the above using `painless` scripting within `Kibana` itself? Something like assign the trimmed value to a new scripted field? I wanted to do it within `Kibana` , since I just wanted to show only the shorter format of the date in the graph.

Any help would be appreciated.

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [January 3, 2017, 5:39pm UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/2 "2017-01-03T17:39:03Z")

</div>

There's a blog post on Painless scripted fields in Kibana here;

> **[Using Painless in Kibana scripted fields
	  	 | Elastic](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)**
>
> Kibana provides powerful ways to search and visualize data stored in Elasticsearch. For the purpose of visualizations, Kibana looks for fields defined in Elasticsearch mappings and presents them as op...

It has some examples using date functions.

Let me know if that doesn't help you.

Regards,  
Lee

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [January 3, 2017, 6:24pm UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/3 "2017-01-03T18:24:21Z")

</div>

You could also try splitting the date value on ", " and using the first element in the resulting array.

CJ

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [January 3, 2017, 6:42pm UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/4 "2017-01-03T18:42:33Z")

</div>

And here's another way to do it, using Moment.js formatting:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b501c0d5b06250214875bcf3ed5aaae28d51e61a.png)

---

<div class="post-metadata">

### Author: ![Kulasangar\_Gowrisang](https://avatars.discourse-cdn.com/v4/letter/k/ce73a5/32.png) [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)
#### Post date: [January 4, 2017, 5:38am UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/5 "2017-01-04T05:38:24Z")

</div>

Thank you @LeeDr and @cjcenizal.

Wrote a scripted field as @cjcenizal suggested, using the `moment.js` date formatting. But then I had to change the `Popularity` to `0` since having it as `1` didn't allow me to access the scripted field in the graph. Making it `0` worked!

A small clarification, what does `Popularity` represents there and how does it affect the scripted field?

Thanks again 🙂

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [January 4, 2017, 3:12pm UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/6 "2017-01-04T15:12:18Z")

</div>

Popularity just makes a field show up in the `Popular` group in the Discover field list. It just makes it easier to find your favorite fields when there are very many.

Clicking Add on a field also increases it's popularity to 1. If I click add on a field like bytes\_in in my example, then remove it from the doc view list by clicking the little `x` next to the name at the top of the column, then it moves from the `Selected Fields` list to the `Popular` list.

In this screenshot, you see the field `direction` in the `Popular` list because I set it's Popularity to 10 in the Settings tab (anything greater than zero makes it appear in the list).

 ![](https://us1.discourse-cdn.com/elastic/original/2X/c/c7094d67b5bd2ec830eb60b11f79a8f8292be235.jpg)

---

<div class="post-metadata">

### Author: ![Kulasangar\_Gowrisang](https://avatars.discourse-cdn.com/v4/letter/k/ce73a5/32.png) [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)
#### Post date: [January 5, 2017, 4:43am UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/7 "2017-01-05T04:43:33Z")

</div>

@LeeDr Oh that's spot on. Understood! 🙂

So it's like moving the field into the popular list, so that it makes the life easier when you're discovering the data.

Thanks again for the explanation!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2017, 4:43am UTC](https://discuss.elastic.co/t/truncate-part-of-an-existing-field-value-to-a-new-field-using-painless/70350/8 "2017-02-02T04:43:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
