This overhaul of the docs structure puts Kibana's documentation more inline with the structure that is used in Elasticsearch. This will help us better organize the docs going forward as more docs are added. This also includes a few necessary content changes for 5.0.
123 lines
4.4 KiB
Text
123 lines
4.4 KiB
Text
[[managing-fields]]
|
|
== Managing Fields
|
|
|
|
The fields for the index pattern are listed in a table. Click a column header to sort the table by that column. Click
|
|
the *Controls* button in the rightmost column for a given field to edit the field's properties. You can manually set
|
|
the field's format from the *Format* drop-down. Format options vary based on the field's type.
|
|
|
|
You can also set the field's popularity value in the *Popularity* text entry box to any desired value. Click the
|
|
*Update Field* button to confirm your changes or *Cancel* to return to the list of fields.
|
|
|
|
Kibana has field formatters for the following field types:
|
|
|
|
* <<field-formatters-string, Strings>>
|
|
* <<field-formatters-date, Dates>>
|
|
* <<field-formatters-geopoint, Geopoints>>
|
|
* <<field-formatters-numeric, Numbers>>
|
|
|
|
[[field-formatters-string]]
|
|
=== String Field Formatters
|
|
|
|
String fields support the `String` and `Url` formatters.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-date]]
|
|
=== Date Field Formatters
|
|
|
|
Date fields support the `Date`, `Url`, and `String` formatters.
|
|
|
|
The `Date` formatter enables you to choose the display format of date stamps using the http://moment.js[moment.js]
|
|
standard format definitions.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-geopoint]]
|
|
=== Geographic Point Field Formatters
|
|
|
|
Geographic point fields support the `String` formatter.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
[[field-formatters-numeric]]
|
|
=== Numeric Field Formatters
|
|
|
|
Numeric fields support the `Url`, `Bytes`, `Duration`, `Number`, `Percentage`, `String`, and `Color` formatters.
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/duration-formatter.asciidoc[]
|
|
|
|
include::field-formatters/color-formatter.asciidoc[]
|
|
|
|
The `Bytes`, `Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
|
|
the https://adamwdraper.github.io/Numeral-js/[numeral.js] standard format definitions.
|
|
|
|
[[scripted-fields]]
|
|
=== Scripted Fields
|
|
|
|
Scripted fields compute data on the fly from the data in your Elasticsearch indices. Scripted field data is shown on
|
|
the Discover tab as part of the document data, and you can use scripted fields in your visualizations.
|
|
Scripted field values are computed at query time so they aren't indexed and cannot be searched.
|
|
|
|
NOTE: Kibana cannot query scripted fields.
|
|
|
|
WARNING: Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on
|
|
Kibana's performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are
|
|
buggy, you'll get exceptions whenever you try to view the dynamically generated data.
|
|
|
|
Scripted fields use the Lucene expression syntax. For more information,
|
|
see {es-ref}modules-scripting-expression.html[
|
|
Lucene Expressions Scripts].
|
|
|
|
You can reference any single value numeric field in your expressions, for example:
|
|
|
|
----
|
|
doc['field_name'].value
|
|
----
|
|
|
|
[float]
|
|
[[create-scripted-field]]
|
|
=== Creating a Scripted Field
|
|
To create a scripted field:
|
|
|
|
. Go to *Settings > Indices*
|
|
. Select the index pattern you want to add a scripted field to.
|
|
. Go to the pattern's *Scripted Fields* tab.
|
|
. Click *Add Scripted Field*.
|
|
. Enter a name for the scripted field.
|
|
. Enter the expression that you want to use to compute a value on the fly from your index data.
|
|
. Click *Save Scripted Field*.
|
|
|
|
For more information about scripted fields in Elasticsearch, see
|
|
{es-ref}modules-scripting.html[Scripting].
|
|
|
|
NOTE: In Elasticsearch releases 1.4.3 and later, this functionality requires you to enable
|
|
{es-ref}modules-scripting.html[dynamic Groovy scripting].
|
|
|
|
[float]
|
|
[[update-scripted-field]]
|
|
=== Updating a Scripted Field
|
|
To modify a scripted field:
|
|
|
|
. Go to *Settings > Indices*
|
|
. Click the *Edit* button for the scripted field you want to change.
|
|
. Make your changes and then click *Save Scripted Field* to update the field.
|
|
|
|
WARNING: Keep in mind that there's no built-in validation of a scripted field. If your scripts are buggy, you'll get
|
|
exceptions whenever you try to view the dynamically generated data.
|
|
|
|
[float]
|
|
[[delete-scripted-field]]
|
|
=== Deleting a Scripted Field
|
|
To delete a scripted field:
|
|
|
|
. Go to *Settings > Indices*
|
|
. Click the *Delete* button for the scripted field you want to remove.
|
|
. Confirm that you really want to delete the field.
|