2287376aeb
* [DOCS] Updates field formatters * Update docs/management/managing-fields.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> * [DOCS] Minor edits Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
127 lines
4.7 KiB
Plaintext
127 lines
4.7 KiB
Plaintext
[[managing-fields]]
|
|
== Field management
|
|
|
|
Whenever possible,
|
|
{kib} uses the same field type for display as {es}. However, a few field types
|
|
{es} supports are not available in {kib}. Use field formatters to customize how your
|
|
fields are displayed in Kibana, regardless of how they are stored in {es}.
|
|
|
|
Kibana provides these field formatters:
|
|
|
|
* <<field-formatters-string, Strings>>
|
|
* <<field-formatters-date, Dates>>
|
|
* <<field-formatters-geopoint, Geopoints>>
|
|
* <<field-formatters-numeric, Numbers>>
|
|
|
|
To format a field:
|
|
|
|
. Open the main menu, and click *Stack Management > Index Patterns*.
|
|
. Click the index pattern that contains the field you want to format.
|
|
. Find the field you want to format and click the edit icon (image:management/index-patterns/images/edit_icon.png[]).
|
|
. Select a format and fill in the details.
|
|
+
|
|
[role="screenshot"]
|
|
image:management/index-patterns/images/edit-field-format.png["Edit field format"]
|
|
|
|
|
|
|
|
[[field-formatters-string]]
|
|
=== String field formatters
|
|
|
|
String fields support the `String` and `Url` formatters.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-date]]
|
|
=== Date field formatters
|
|
|
|
Date fields support the `Date`, `Url`, and `String` formatters.
|
|
|
|
The `Date` formatter enables you to choose the display format of date stamps using the https://momentjs.com/[moment.js]
|
|
standard format definitions.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-geopoint]]
|
|
=== Geographic point field formatters
|
|
|
|
Geographic point fields support the `String` formatter.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
[[field-formatters-numeric]]
|
|
=== Numeric field formatters
|
|
|
|
Numeric fields support the `Url`, `Bytes`, `Duration`, `Number`, `Percentage`, `String`, and `Color` formatters.
|
|
|
|
The `Bytes`, `Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
|
|
the <<numeral, Elastic numeral pattern>> syntax that {kib} maintains.
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/duration-formatter.asciidoc[]
|
|
|
|
include::field-formatters/color-formatter.asciidoc[]
|
|
|
|
[[scripted-fields]]
|
|
=== Scripted fields
|
|
|
|
Scripted fields compute data on the fly from the data in your {es} indices. The data is shown on
|
|
the Discover tab as part of the document data, and you can use scripted fields in your visualizations. You query scripted fields with the <<kuery-query, {kib} query language>>, and can filter them using the filter bar. The scripted field values are computed at query time, so they aren't indexed and cannot be searched using the {kib} default
|
|
query language.
|
|
|
|
WARNING: Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on
|
|
{kib} performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are
|
|
buggy, you'll get exceptions whenever you try to view the dynamically generated data.
|
|
|
|
When you define a scripted field in {kib}, you have a choice of the {ref}/modules-scripting-expression.html[Lucene expressions] or the
|
|
{ref}/modules-scripting-painless.html[Painless] scripting language.
|
|
|
|
You can reference any single value numeric field in your expressions, for example:
|
|
|
|
----
|
|
doc['field_name'].value
|
|
----
|
|
|
|
For more information on scripted fields and additional examples, refer to
|
|
https://www.elastic.co/blog/using-painless-kibana-scripted-fields[Using Painless in {kib} scripted fields]
|
|
|
|
[float]
|
|
[[create-scripted-field]]
|
|
=== Create a scripted field
|
|
|
|
. Open the main menu, then click *Stack Management > Index Patterns*.
|
|
. Select the index pattern you want to add a scripted field to.
|
|
. Go to the *Scripted fields* tab for the index pattern, then click *Add scripted field*.
|
|
. Enter a name for the scripted field.
|
|
. Enter the expression that you want to use to compute a value on the fly from your index data.
|
|
. Click *Create field*.
|
|
|
|
For more information about scripted fields in {es}, see
|
|
{ref}/modules-scripting.html[Scripting].
|
|
|
|
[float]
|
|
[[update-scripted-field]]
|
|
=== Update a scripted field
|
|
|
|
. Click the *Scripted fields* tab for the index pattern.
|
|
. Click the *Edit* button for the scripted field you want to change.
|
|
. Make your changes, then click *Save field*.
|
|
|
|
WARNING: Built-in validation is unsupported for scripted fields. If your scripts are buggy, you'll get
|
|
exceptions whenever you try to view the dynamically generated data.
|
|
|
|
[float]
|
|
[[delete-scripted-field]]
|
|
=== Delete a scripted field
|
|
|
|
. Click the *Scripted fields* tab for the index pattern.
|
|
. Click *Delete* for the scripted field you want to remove.
|
|
. Click *Delete* on the confirmation window.
|