PT 8.61

Introduction

There are times when the fields from an index pattern don’t quite meet our needs.   We can add Scripted Fields to Index Patterns to manipulate data in our row to create more meaningful visualizations for our users.

Limitations

• Scripted fields only work on a single document.   A document represents one row of data in our dataset referenced by that index pattern.  We can’t reference multiple documents in our dataset.
• There is no way to reference data in other documents that may have a parent/child relationship with our current document.
• Scripted fields have performance implications. 

Reference

Here are two good references to using scripted fields in our index patterns:

• Using Painless in Kibana scripted fields
• Elastic Search Guide Scripting

The Example

Here we have a simple bar chart showing employee training classes.   The X-Axis is Class Type.

We already have the long translate value for our Class Type field showing on the X-Axis.   But the user wants to see both the description and field value on the X-Axis.  Not just one or the other.

The way we do this is to use a Scripted field to combine the Description with the field value and use that scripted field as the X-Axis.

Creating a Scripted Field

Open the index pattern in Insights Stack Management Menu. 

First, find your fields that you want to reference in your script. 

This image only shows the “Class Type” field, which is the Translate Value of the field.  Not shown here is the other field “Type”, which contains the Long Translate Value for that field.

Using the Scripted Field in a Visualization

Click on the Scripted field tab on the page and then click on the “Add scripted field” button on the middle right of the page.

Give the field a descriptive name.  I like to prefix my scripted field names with “SCR_” so I can quickly identify them when working with visualizations.

Leave the language as “painless” and set the field type appropriately.   In this case, I want the scripted field to result in a string value since I am combining two existing strings in a larger string.

Scroll down to the bottom of the page and type in your script.

In our example we are using the Open Search’s document object (doc) to reference the fields in our index pattern to combing them.

doc['Type'].value + '-' + doc['Course Type'].value

Scroll down and click the “Save Field” button to save the scripted field to the index pattern.

Use the scripted field in a Visualization

Return to the visualization and replace the X-Axis field with the new scripted field.

Update the visualization and we see that the X-Axis now shows the Class Type value as well as the description.

Conclusion

Insight’s scripted fields give us real power to manipulate the data in index patterns to create meaningful charts for our users. 

Depending on the complexity and number of scripted fields, performance can be affected.  Please test these visualizations before publishing to the users.