mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 01:38:56 -04:00
Adds redirects
This commit is contained in:
KOTungseth
parent
0687c3ebcf
commit
15b3b1e869
3 changed files with 17 additions and 279 deletions
|
|
@ -219,7 +219,7 @@ To customize how {kib} displays data fields, use the formatting options.
|
|||
. Select *Set format*, then enter the *Format* for the field.
|
||||
|
||||
[float]
|
||||
[[field-formatters-string]]
|
||||
[[string-field-formatters]]
|
||||
==== String field formatters
|
||||
|
||||
String fields support *String* and *Url* formatters.
|
||||
|
|
|
|||
|
|
@ -1,273 +0,0 @@
|
|||
[[managing-fields]]
|
||||
== Field management
|
||||
|
||||
Whenever possible,
|
||||
{kib} uses the same field type for display as {es}. However, a few field types
|
||||
{es} supports are not available in {kib}. Use field formatters to customize how your
|
||||
fields are displayed in Kibana, regardless of how they are stored in {es}.
|
||||
|
||||
Kibana provides these field formatters:
|
||||
|
||||
* <<field-formatters-string, Strings>>
|
||||
* <<field-formatters-date, Dates>>
|
||||
* <<field-formatters-geopoint, Geopoints>>
|
||||
* <<field-formatters-numeric, Numbers>>
|
||||
|
||||
To format a field:
|
||||
|
||||
. Open the main menu, and click *Stack Management > Index Patterns*.
|
||||
. Click the index pattern that contains the field you want to format.
|
||||
. Find the field you want to format and click the edit icon (image:management/index-patterns/images/edit_icon.png[]).
|
||||
. Enter a custom label for the field, if needed.
|
||||
. Select a format and fill in the details.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:management/index-patterns/images/edit-field-format.png["Edit field format"]
|
||||
|
||||
|
||||
|
||||
[[field-formatters-string]]
|
||||
=== String field formatters
|
||||
|
||||
String fields support the `String` and `Url` formatters.
|
||||
|
||||
include::field-formatters/string-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/url-formatter.asciidoc[]
|
||||
|
||||
[[field-formatters-date]]
|
||||
=== Date field formatters
|
||||
|
||||
Date fields support the `Date`, `Url`, and `String` formatters.
|
||||
|
||||
The `Date` formatter enables you to choose the display format of date stamps using the https://momentjs.com/[moment.js]
|
||||
standard format definitions.
|
||||
|
||||
include::field-formatters/string-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/url-formatter.asciidoc[]
|
||||
|
||||
[[field-formatters-geopoint]]
|
||||
=== Geographic point field formatters
|
||||
|
||||
Geographic point fields support the `String` formatter.
|
||||
|
||||
include::field-formatters/string-formatter.asciidoc[]
|
||||
|
||||
[[field-formatters-numeric]]
|
||||
=== Numeric field formatters
|
||||
|
||||
Numeric fields support the `Url`, `Bytes`, `Duration`, `Number`, `Percentage`, `Histogram`, `String`, and `Color` formatters.
|
||||
|
||||
The `Bytes`, `Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
|
||||
the <<numeral, Elastic numeral pattern>> syntax that {kib} maintains.
|
||||
|
||||
The `Histogram` formatter is only used for the {ref}/histogram.html[histogram field type]. When using the `Histogram` formatter,
|
||||
you can apply the `Number`, `Bytes`, or `Percentage` format to the aggregated data.
|
||||
|
||||
`Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
|
||||
the <<numeral, Elastic numeral pattern>> syntax that {kib} maintains.
|
||||
|
||||
include::field-formatters/url-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/string-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/duration-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/color-formatter.asciidoc[]
|
||||
|
||||
[[scripted-fields]]
|
||||
=== Add scripted fields to index patterns
|
||||
|
||||
deprecated::[7.13,Use {ref}/runtime.html[runtime fields] instead of scripted fields. Runtime fields support Painless scripts and provide greater flexibility.]
|
||||
|
||||
Scripted fields compute data on the fly from the data in your {es} indices. The data is shown on
|
||||
the Discover tab as part of the document data, and you can use scripted fields in your visualizations. You query scripted fields with the <<kuery-query, {kib} query language>>, and can filter them using the filter bar. The scripted field values are computed at query time, so they aren't indexed and cannot be searched using the {kib} default
|
||||
query language.
|
||||
|
||||
WARNING: Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on
|
||||
{kib} performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are
|
||||
buggy, you'll get exceptions whenever you try to view the dynamically generated data.
|
||||
|
||||
When you define a scripted field in {kib}, you have a choice of the {ref}/modules-scripting-expression.html[Lucene expressions] or the
|
||||
{ref}/modules-scripting-painless.html[Painless] scripting language.
|
||||
|
||||
You can reference any single value numeric field in your expressions, for example:
|
||||
|
||||
----
|
||||
doc['field_name'].value
|
||||
----
|
||||
|
||||
For more information on scripted fields and additional examples, refer to
|
||||
https://www.elastic.co/blog/using-painless-kibana-scripted-fields[Using Painless in {kib} scripted fields]
|
||||
|
||||
[float]
|
||||
[[create-scripted-field]]
|
||||
=== Create a scripted field
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Select the index pattern you want to add a scripted field to.
|
||||
. Go to the *Scripted fields* tab for the index pattern, then click *Add scripted field*.
|
||||
. Enter a name for the scripted field.
|
||||
. Enter the expression that you want to use to compute a value on the fly from your index data.
|
||||
. Click *Create field*.
|
||||
|
||||
For more information about scripted fields in {es}, see
|
||||
{ref}/modules-scripting.html[Scripting].
|
||||
|
||||
[float]
|
||||
[[update-scripted-field]]
|
||||
=== Update a scripted field
|
||||
|
||||
. Click the *Scripted fields* tab for the index pattern.
|
||||
. Click the *Edit* button for the scripted field you want to change.
|
||||
. Make your changes, then click *Save field*.
|
||||
|
||||
WARNING: Built-in validation is unsupported for scripted fields. If your scripts are buggy, you'll get
|
||||
exceptions whenever you try to view the dynamically generated data.
|
||||
|
||||
[float]
|
||||
[[delete-scripted-field]]
|
||||
=== Delete a scripted field
|
||||
|
||||
. Click the *Scripted fields* tab for the index pattern.
|
||||
. Click *Delete* for the scripted field you want to remove.
|
||||
. Click *Delete* on the confirmation window.
|
||||
|
||||
[[runtime-fields]]
|
||||
=== Explore your data with runtime fields
|
||||
|
||||
Runtime fields are fields that you add to documents after you've ingested, and are evaluated at query time. With runtime fields, you allow for a smaller index and
|
||||
faster ingest time so that you can use less resources and reduce your operating costs.
|
||||
|
||||
When you use runtime fields, you can:
|
||||
|
||||
* Add fields to existing documents without reindexing your data.
|
||||
|
||||
* Start working on your data without first understanding the structure.
|
||||
|
||||
* Override the returned values from index fields.
|
||||
|
||||
* Define fields for a specific use without modifying the underlying schema.
|
||||
|
||||
You can view runtime field data in *Discover*, create visualizations with runtime fields using the visualization editors, and create alerts for runtime fields.
|
||||
|
||||
The following visualization editors support runtime fields:
|
||||
|
||||
* *Lens*
|
||||
* *Maps*
|
||||
* *TSVB*
|
||||
* *Timelion*
|
||||
* *Aggregation-based*
|
||||
|
||||
WARNING: Runtime fields can impact {kib} performance. When you run a query, {es} uses the fields you index first to shorten the response time.
|
||||
Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields {es} uses to calculate values.
|
||||
|
||||
For more information, refer to {ref}/runtime.html[Runtime fields].
|
||||
|
||||
[float]
|
||||
[[create-runtime-fields]]
|
||||
=== Create runtime fields
|
||||
|
||||
Create runtime fields in your index patterns, or create runtime fields in *Discover* and *Lens*.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
|
||||
. Select the index pattern you want to add the runtime field to, then click *Add field*.
|
||||
|
||||
. Enter a *Name* for the runtime field, then select the field *Type*.
|
||||
|
||||
. Select *Set value*, then define the field value by emitting a single value using the {ref}/modules-scripting-painless.html[Painless scripting language].
|
||||
|
||||
. Click *Create field*.
|
||||
//+
|
||||
//For information on how to create runtime fields in *Discover*, refer to <<add-field-in-discover,Add a field>>.
|
||||
+
|
||||
For information on how to create runtime fields in *Lens*, refer to <<add-fields-in-lens,Add fields>>.
|
||||
|
||||
[float]
|
||||
[[runtime-field-examples]]
|
||||
=== Runtime field examples
|
||||
|
||||
Try the runtime field examples on your own using the *Sample web logs* data index pattern.
|
||||
|
||||
[float]
|
||||
[[simple-hello-world-example]]
|
||||
==== Return a keyword value
|
||||
|
||||
To return `Hello World!` value:
|
||||
|
||||
----
|
||||
emit("Hello World!");
|
||||
----
|
||||
|
||||
[float]
|
||||
[[perform-a-calculation-on-a-single-field]]
|
||||
==== Perform a calculation on a single field
|
||||
|
||||
Calculate kilobytes from bytes:
|
||||
|
||||
----
|
||||
emit(doc['bytes'].value / 1024)
|
||||
----
|
||||
|
||||
[float]
|
||||
[[return-substring]]
|
||||
==== Return a substring
|
||||
|
||||
Return the string that appears after the last slash in the URL:
|
||||
|
||||
----
|
||||
def path = doc["url.keyword"].value;
|
||||
if (path != null) {
|
||||
int lastSlashIndex = path.lastIndexOf('/');
|
||||
if (lastSlashIndex > 0) {
|
||||
emit(path.substring(lastSlashIndex+1));
|
||||
return;
|
||||
}
|
||||
}
|
||||
emit("");
|
||||
----
|
||||
|
||||
[float]
|
||||
[[replace-nulls-with-blanks]]
|
||||
==== Replace nulls with blanks
|
||||
|
||||
Replace null values with none values:
|
||||
|
||||
----
|
||||
def source = doc['referer'].value;
|
||||
if (source != null) {
|
||||
emit(source);
|
||||
return;
|
||||
}
|
||||
else {
|
||||
emit("None");
|
||||
}
|
||||
----
|
||||
|
||||
Specify operating system condition:
|
||||
|
||||
----
|
||||
def source = doc['machine.os.keyword'].value;
|
||||
if (source != "") {
|
||||
emit(source);
|
||||
}
|
||||
else {
|
||||
emit("None");
|
||||
}
|
||||
----
|
||||
|
||||
[float]
|
||||
[[manage-runtime-fields]]
|
||||
=== Manage runtime fields
|
||||
|
||||
Edit the settings for runtime fields, or remove runtime fields from index patterns.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
|
||||
. Select the index pattern that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -279,26 +279,37 @@ This content has moved. Refer to <<dashboard, **Dashboard**>>.
|
|||
[role="exclude",id="ingest-node-pipelines"]
|
||||
== Ingest Node Pipelines
|
||||
|
||||
This content has moved. See {ref}/ingest.html[Ingest pipelines].
|
||||
This content has moved. Refer to {ref}/ingest.html[Ingest pipelines].
|
||||
|
||||
|
||||
[role="exclude",id="create-panels-with-timelion"]
|
||||
== Timelion
|
||||
|
||||
This content has moved. refer to <<timelion>>.
|
||||
This content has moved. Refer to <<timelion>>.
|
||||
|
||||
|
||||
[role="exclude",id="space-rbac-tutorial"]
|
||||
== Tutorial: Use role-based access control to customize Kibana spaces
|
||||
|
||||
This content has moved. refer to <<tutorial-secure-access-to-kibana>>.
|
||||
This content has moved. Refer to <<tutorial-secure-access-to-kibana>>.
|
||||
|
||||
[role="exclude",id="search"]
|
||||
== Search your data
|
||||
|
||||
This content has moved. refer to <<kuery-query>>.
|
||||
This content has moved. Refer to <<kuery-query>>.
|
||||
|
||||
[role="exclude",id="discover-document-context"]
|
||||
== View surrounding documents
|
||||
|
||||
This content has moved. refer to <<discover-view-surrounding-documents>>.
|
||||
This content has moved. Refer to <<discover-view-surrounding-documents>>.
|
||||
|
||||
[role="exclude",id="reload-fields"]
|
||||
== Explore and configure the data fields
|
||||
|
||||
This content has moved. Refer to <<managing-fields>>.
|
||||
|
||||
[role="exclude",id="field-formatters-string"]
|
||||
== String field formatters
|
||||
|
||||
This content has moved. Refer to <<string-field-formatters>>.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue