Vega Error

Elastic Stack Kibana
1

I'm trying to create a vega visual, but receiving 'invalid field type "undefined"'

The 2 fields are strings, and the @timestamp a a date field. I've also tried it without converting the @timestamp to a date, and passing the @timestamp to x, but that gives me the same error.

Here is the json:

{
  $schema: https: //vega.github.io/schema/vega-lite/v2.json
  mark: point

  data: {
    url: {
      %context%: true
      %timefield%: @timestamp
      index: service-appointment-prod-*
      body: {
        size: 10000
        _source: [
                "@timestamp",
                "system.process.memory.rss.bytes",
                "system.filesystem.files"
            ]
        }
    }
    format: { property: "hits.hits"
    }
}

  transform: [
        {
      calculate: "toDate(datum._source['@timestamp'])"
      as: "time"
        }
    ]

      encoding: {
    x: {
      field: time
      type: temporal
      axis: { title: false
            }
        }
    y: {
      field: _source.system.process.memory.rss.bytes
      type: quantative
      axis: { title: "bytes"
            }
        }
    }
}

I am able to perform a search using those fields:

GET service-appointment-prod-*/_search
{
  "size": 10,
  "_source": [ "@timestamp","system.process.memory.rss.bytes","host"]
}

returns:

{
  "took": 51,
  "timed_out": false,
  "_shards": {
    "total": 119,
    "successful": 119,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 17727946,
    "max_score": 1,
    "hits": [
      {
        "_index": "service-appointment-prod-2018.03.15",
        "_type": "doc",
        "_id": "RTmjK2IBt7mrOhHx1Cni",
        "_score": 1,
        "_source": {
          "@timestamp": "2018-03-15T21:49:38.880Z",
          "host": "stlrck-vcrh001"
        }
      },
    {
    "_index": "service-appointment-prod-2018.03.15",
    "_type": "doc",
    "_id": "1Z6jK2IB4hB-5zYa1M_i",
    "_score": 1,
    "_source": {
      "@timestamp": "2018-03-15T21:49:39.033Z",
      "system": {
        "process": {
          "memory": {
            "rss": {
              "bytes": 1018032128
            }
          }
        }
      },
      "host": "stlrck-vcrh001"
    }
  },
2

I've cleaned up a few mistakes that I've made, it appears that I'm not able to use fields with a "." in them.

Here is my simplified version

{
  $schema: https: //vega.github.io/schema/vega-lite/v2.json
  mark: point

  data: {
    url: {
      %context%: true
      %timefield%: @timestamp
      index: service-appointment-prod-*
      body: {
        size: 100,
        _source: [
                "@timestamp",
                "system.process.memory.rss.bytes"
            ]
        }
    },
    format: { property: "hits.hits" }
  },
  transform: [
        { calculate: "toDate(datum._source['@timestamp'])" as: "time"},
        { calculate: "datum._source['system.process.memory.rss.bytes']" as: "host"}
    
    ],
  encoding: {
    x: { field: "time", type: "temporal" }
    y: { field: "host", type: "nominal"  }
  }
}

if I have the field "system.process.memory.rss.bytes" in the json, I receive this error:
Cannot read property 'process' of undefined

but when I swap the field "system.process.memory.rss.bytes" for the field "host" it works.

3

You have to escape the . so try something like

calculate: "datum._source['system\.process\.memory\.rss\.bytes']" as: "host"}

The official vega documentation can be found at https://github.com/vega/vega/wiki/Marks#value-references

1 Like
4

I had tried that as well, I receive a bad string at the line with the escaped string.

{
  $schema: https://vega.github.io/schema/vega-lite/v2.json
  "data": {
    # URL object is a context-aware query to Elasticsearch
    "url": {
      # The %-enclosed keys are handled by Kibana to modify the query
      # before it gets sent to Elasticsearch. Context is the search
      # filter as shown above the dashboard. Timefield uses the value 
      # of the time picker from the upper right corner.
      %context%: true
      %timefield%: @timestamp
      "index": service-appointment-prod-*
      "body": {
        size: 1000
        _source: ["@timestamp","system.process.memory.rss.bytes"] 
      }
    }
    # We only need the content of hits.hits array
    format: {property: "hits.hits"}
  }
  # Parse timestamp into a javascript date value
  transform: [
    {calculate: "toDate(datum._source['@timestamp'])", as: "time"},
    {calculate: "datum._source['system\.process\.memory\.rss\.bytes']" as: "host"}
  ],
  # Draw a circle, with x being the time field, and y - number of bytes
  mark: point
  encoding: 
  {
  x: {field: "time", type: "temporal", axis: { title: false }
  },
  y: {field: "host", type: "nominal" }

  }
}
5

I've also attempted the double slash escape from the vega-lite docs, to no avail.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.