2016-10-25 03:41:32 +02:00
[[managing-fields]]
2020-11-05 21:37:58 +01:00
== Field management
2016-10-25 03:41:32 +02:00
2020-11-05 21:37:58 +01:00
Whenever possible,
{kib} uses the same field type for display as {es}. However, a few field types
{es} supports are not available in {kib}. Use field formatters to customize how your
fields are displayed in Kibana, regardless of how they are stored in {es}.
2016-10-25 03:41:32 +02:00
2020-11-05 21:37:58 +01:00
Kibana provides these field formatters:
2020-02-06 18:16:32 +01:00
2020-11-05 21:37:58 +01:00
* <<field-formatters-string, Strings>>
* <<field-formatters-date, Dates>>
* <<field-formatters-geopoint, Geopoints>>
* <<field-formatters-numeric, Numbers>>
2020-02-06 18:16:32 +01:00
2020-11-05 21:37:58 +01:00
To format a field:
2020-02-06 18:16:32 +01:00
2020-11-05 21:37:58 +01:00
. Open the main menu, and click *Stack Management > Index Patterns*.
. Click the index pattern that contains the field you want to format.
. Find the field you want to format and click the edit icon (image:management/index-patterns/images/edit_icon.png[]).
2021-01-26 05:54:10 +01:00
. Enter a custom label for the field, if needed.
2020-11-05 21:37:58 +01:00
. Select a format and fill in the details.
2020-02-06 18:16:32 +01:00
+
2020-11-05 21:37:58 +01:00
[role="screenshot"]
image:management/index-patterns/images/edit-field-format.png["Edit field format"]
2016-10-25 03:41:32 +02:00
[[field-formatters-string]]
2020-03-11 14:58:33 +01:00
=== String field formatters
2016-10-25 03:41:32 +02:00
String fields support the `String` and `Url` formatters.
include::field-formatters/string-formatter.asciidoc[]
include::field-formatters/url-formatter.asciidoc[]
[[field-formatters-date]]
2020-03-11 14:58:33 +01:00
=== Date field formatters
2016-10-25 03:41:32 +02:00
Date fields support the `Date`, `Url`, and `String` formatters.
2019-11-20 20:08:27 +01:00
The `Date` formatter enables you to choose the display format of date stamps using the https://momentjs.com/[moment.js]
2016-10-25 03:41:32 +02:00
standard format definitions.
include::field-formatters/string-formatter.asciidoc[]
include::field-formatters/url-formatter.asciidoc[]
[[field-formatters-geopoint]]
2020-03-11 14:58:33 +01:00
=== Geographic point field formatters
2016-10-25 03:41:32 +02:00
Geographic point fields support the `String` formatter.
include::field-formatters/string-formatter.asciidoc[]
[[field-formatters-numeric]]
2020-03-11 14:58:33 +01:00
=== Numeric field formatters
2016-10-25 03:41:32 +02:00
2021-03-03 19:13:57 +01:00
Numeric fields support the `Url`, `Bytes`, `Duration`, `Number`, `Percentage`, `Histogram`, `String`, and `Color` formatters.
2016-10-25 03:41:32 +02:00
2020-02-26 20:17:59 +01:00
The `Bytes`, `Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
2020-03-11 14:58:33 +01:00
the <<numeral, Elastic numeral pattern>> syntax that {kib} maintains.
2020-02-26 20:17:59 +01:00
2021-03-03 19:13:57 +01:00
The `Histogram` formatter is only used for the {ref}/histogram.html[histogram field type]. When using the `Histogram` formatter,
you can apply the `Number`, `Bytes`, or `Percentage` format to the aggregated data.
`Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
the <<numeral, Elastic numeral pattern>> syntax that {kib} maintains.
2016-10-25 03:41:32 +02:00
include::field-formatters/url-formatter.asciidoc[]
include::field-formatters/string-formatter.asciidoc[]
include::field-formatters/duration-formatter.asciidoc[]
include::field-formatters/color-formatter.asciidoc[]
[[scripted-fields]]
2020-03-11 14:58:33 +01:00
=== Scripted fields
2016-10-25 03:41:32 +02:00
2020-03-11 14:58:33 +01:00
Scripted fields compute data on the fly from the data in your {es} indices. The data is shown on
the Discover tab as part of the document data, and you can use scripted fields in your visualizations. You query scripted fields with the <<kuery-query, {kib} query language>>, and can filter them using the filter bar. The scripted field values are computed at query time, so they aren't indexed and cannot be searched using the {kib} default
query language.
2016-10-25 03:41:32 +02:00
WARNING: Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on
2020-03-11 14:58:33 +01:00
{kib} performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are
2016-10-25 03:41:32 +02:00
buggy, you'll get exceptions whenever you try to view the dynamically generated data.
2020-11-05 20:30:15 +01:00
When you define a scripted field in {kib}, you have a choice of the {ref}/modules-scripting-expression.html[Lucene expressions] or the
{ref}/modules-scripting-painless.html[Painless] scripting language.
2016-10-25 03:41:32 +02:00
You can reference any single value numeric field in your expressions, for example:
----
doc['field_name'].value
----
2020-03-11 14:58:33 +01:00
For more information on scripted fields and additional examples, refer to
https://www.elastic.co/blog/using-painless-kibana-scripted-fields[Using Painless in {kib} scripted fields]
2017-01-13 16:54:06 +01:00
2016-10-25 03:41:32 +02:00
[float]
[[create-scripted-field]]
2020-03-11 14:58:33 +01:00
=== Create a scripted field
2016-10-25 03:41:32 +02:00
2020-10-22 16:06:51 +02:00
. Open the main menu, then click *Stack Management > Index Patterns*.
2016-10-25 03:41:32 +02:00
. Select the index pattern you want to add a scripted field to.
2020-03-11 14:58:33 +01:00
. Go to the *Scripted fields* tab for the index pattern, then click *Add scripted field*.
2016-10-25 03:41:32 +02:00
. Enter a name for the scripted field.
. Enter the expression that you want to use to compute a value on the fly from your index data.
2019-01-09 21:18:53 +01:00
. Click *Create field*.
2016-10-25 03:41:32 +02:00
2020-03-11 14:58:33 +01:00
For more information about scripted fields in {es}, see
2017-06-27 19:13:42 +02:00
{ref}/modules-scripting.html[Scripting].
2016-10-25 03:41:32 +02:00
[float]
[[update-scripted-field]]
2020-03-11 14:58:33 +01:00
=== Update a scripted field
2016-10-25 03:41:32 +02:00
2020-03-11 14:58:33 +01:00
. Click the *Scripted fields* tab for the index pattern.
2016-10-25 03:41:32 +02:00
. Click the *Edit* button for the scripted field you want to change.
2020-03-11 14:58:33 +01:00
. Make your changes, then click *Save field*.
2016-10-25 03:41:32 +02:00
2020-03-11 14:58:33 +01:00
WARNING: Built-in validation is unsupported for scripted fields. If your scripts are buggy, you'll get
2016-10-25 03:41:32 +02:00
exceptions whenever you try to view the dynamically generated data.
[float]
[[delete-scripted-field]]
2020-03-11 14:58:33 +01:00
=== Delete a scripted field
2016-10-25 03:41:32 +02:00
2020-03-11 14:58:33 +01:00
. Click the *Scripted fields* tab for the index pattern.
. Click *Delete* for the scripted field you want to remove.
. Click *Delete* on the confirmation window.