Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I create a scripted field in kibana 4 that uses aggregation?

Kibana 4 has a new feature to add scripted fields and write custom scripts. I wish to write a script that uses aggregations. Its easy to do simple arithmetic operations in scripted scripts but for doing aggregations I am puzzled. I am a new comer to Kibana and elasticsearch, I am looking for a sample script for beginning..

like image 550
Shubham Mishra Avatar asked Mar 31 '15 10:03

Shubham Mishra


People also ask

How do I add a scripted field in Kibana?

Select the data view you want to add a scripted field to. Select the Scripted fields tab, then click Add scripted field. Enter a Name for the scripted field, then enter the Script you want to use to compute a value on the fly from your index data. Click Create field.

How do I create a runtime field in Kibana?

In the Discover App of Kibana you can add a runtime field using the button next to the index pattern chooser. Just click on “Add field to index pattern” to add a new field. After clicking on that you will see a new Sidebar. To add a runtime field you need to activate “Set value”.

How do I create a script in Elasticsearch?

Wherever scripting is supported in the Elasticsearch APIs, the syntax follows the same pattern; you specify the language of your script, provide the script logic (or source), and add parameters that are passed into the script: "script": { "lang": "...", "source" | "id": "...", "params": { ... } }


1 Answers

Scripted fields in Kibana are powered by lucene expressions, which only support numeric operations right now. Support for things like string manipulation and date parsing will probably be added at some point, but I doubt scripts will even support executing aggregations.

Scripted fields are primarily for converting a number before using it, or creating a synthetic field which is the combination of two or more other fields. Down the road they may even support things like extracting the day of the week from a date, or the portion of a string that matches a regular expression.

like image 156
Spencer Alger Avatar answered Oct 22 '22 00:10

Spencer Alger