Kibana: Field value replacement formatter (lookup table)

[skearns64]

Often, when I'm visualizing data in Kibana, I have a numeric field (or string ID) in my data that maps to a logical concept that would be easier to understand if it were mapped to a pretty-print string.

To take a simple example: City Crime data

The data contains a field called INCIDENT_TYPE_DESCRIPTION, which has some human readable values, like ROBBERY, but others are harder to intuit, like VAL. In this case, VAL stands for Violator at Large, which would be a much better value to show in the legend. Similarly, the ReptDistrict, has string values like D4 that correspond to more useful terms like "South End".

It would be excellent if there was a way to map the values of a particular field to strings I specify. While Legends are the most useful place for me, it might be nice to be able to see the readable version everywhere we show the field, though it would be important to have the original value present when viewing the document detailed table view, for example.

For the purposes of this issue, a static mapping is sufficient, though a follow-on feature request would be to allow dynamic lookups of some kind. Perhaps this fits as a type of field formatter?

[AnkurMathur14]

+1 It would be excellent

[spalger]

If someone is interested in creating this field formatted they could check out the string formatter for an example.

All on the properties of this class are important except the transformOpts (Which are simply used by the editor) and _base64Decode (which is used by the _convert() method)

[dw-milla]

Can you tell me how to deploy and use the string formatter example? We're running Kibana 4.1.2 and I'd love to be able to convert some specific string ID's to human-readable format.

[lijamie98]

+1

[guruxu]

Will this be considered? Similar to #4361?

I've managed to get my display label via parent/child inner_hits, but Kibana is not allowing inner hit fields to be used.

[benson-basis]

@skearns64 Please? Please? You'd be saving my daughter a lot of copying and pasting if you could get this done.

[tbragin]

via @kellihall

Describe the feature:
Would love to have Lookup Table functionality added to the Kibana interface. This would be the equivalent to what is in the Splunk interface.
For example:

• I have an index with member information, and part of their information is the state they live in, but it's abbreviated.
• I have a second index that has state information, including the abbreviation, full state name, etc.
• In Splunk, you would simply tell the system to get the state's full name from the other index by identifying it as a lookup table.
• Having a very simple way of doing this in Kibana would be awesomely efficient.

[dortort]

+1

[dizzzyroma]

+1

[pemontto]

👍

[robinmitra]

+1

[dinnyosz]

+1

[Kudryavets]

+1

[sy43165]

+1

[markchagers]

+1 definitely very useful

[kachenjr]

+1

[ellismendez]

+1

[madkoala]

+1

[jag959]

+1

[piotrkochan]

+1

[jantoniuk]

+1

[abunet]

+1

[cinhtau]

:+1:

[guylaurent]

+1

[cumulate]

+1
I'm a newbie here. Is there a way to implement/customize the lookup feature via plugin??

[JoeyJo-JoJuniorShabadoo]

+1

[rahulKolluri]

+1

[LeeDr]

For small sets of values this could be done with a scripted field like this;

if (doc['response.raw'].value == "200") {
  return "OK";
} else if (doc['response.raw'].value == "404") {
  return "Not Found";
} else if (doc['response.raw'].value == "503") {
  return "Redirected";
} else {
  return "Unknown"
}

But you wouldn't want to do that for a lot of potential values.

[cjcenizal]

This was address for static lookups by https://github.com/elastic/kibana/pull/19637. For dynamic lookups, we could implement custom script field formatters (https://github.com/elastic/kibana/issues/3585). Closing this in favor of https://github.com/elastic/kibana/issues/3585.