Skip to content

Commit

Permalink
[DOCS] Adds runtime fields (#99395) (#99990)
Browse files Browse the repository at this point in the history
* [DOCS] Runtime fields

* [DOCS] Runtime fields

* Adds examples and Lens changes

* Review comments

* Adds redirects

* Review comments

* Revert "Review comments"

This reverts commit 537732a.

* Review comments

* Fixes broken link

* Removes duplicate link

Co-authored-by: Kaarina Tungseth <kaarinatungseth@Kaarinas-MacBook-Pro.local>

Co-authored-by: Kaarina Tungseth <kaarinatungseth@Kaarinas-MacBook-Pro.local>
  • Loading branch information
KOTungseth and Kaarina Tungseth authored May 12, 2021
1 parent 7ef5370 commit 7bf11e9
Show file tree
Hide file tree
Showing 16 changed files with 349 additions and 241 deletions.
79 changes: 12 additions & 67 deletions docs/concepts/index-patterns.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,9 @@ or all indices that contain your data. It can also point to a

You’ll learn how to:

* Create an index pattern
* Explore and configure the data fields
* Create index patterns
* Set the default index pattern
* Delete an index pattern
* Delete index patterns

[float]
[[index-patterns-read-only-access]]
Expand Down Expand Up @@ -133,77 +132,23 @@ To exclude a cluster, use `cluster_*:logstash-*,cluster_one:-*`.
Once an index pattern is configured using the {ccs} syntax, all searches and
aggregations using that index pattern in {kib} take advantage of {ccs}.


[float]
[[reload-fields]]
=== Explore and configure the data fields

To explore and configure the data fields in your index pattern, open the main menu, then click
*Stack Management > Index Patterns*. Each field has a {ref}/mapping.html[mapping],
which indicates the type of data the field contains in {es},
such as strings or boolean values. The field mapping also determines
how you can use the field, such as whether it can be searched or aggregated.

When a new field is added to the index, the index pattern field list is updated
the next time the index pattern is loaded, for example, when you load the page or
move between {kib} apps.

[role="screenshot"]
image:management/index-patterns/images/new-index-pattern.png["Create index pattern"]

[float]
=== Format the display of common field types

Whenever possible, {kib} uses the same field type for display as
{es}. However, some field types that {es} supports are not available
in {kib}. Using field formatters, you can manually change the field type in {kib} to display your data the way you prefer
to see it, regardless of how it is stored in {es}.

For example, if you store
date values in {es}, you can use a {kib} field formatter to change the display to mm/dd/yyyy format.
{kib} has field formatters for
<<field-formatters-string, strings>>,
<<field-formatters-date, dates>>,
<<field-formatters-geopoint, geopoints>>,
and <<field-formatters-numeric, numbers>>.

To customize the displayed field name provided by {es}, you can
use *Custom Label* .

A popularity counter keeps track of the fields you use most often.
The top five most popular fields and their values are displayed in <<discover,*Discover*>>.

To edit the field display, click the edit icon
(image:management/index-patterns/images/edit_icon.png[]) in the index pattern detail view.

[role="screenshot"]
image:management/index-patterns/images/edit-field-format.png["Edit field format"]

[float]
[[default-index-pattern]]
=== Set the default index pattern
[[delete-index-pattern]]
=== Delete index patterns

The first index pattern you create is automatically designated as the default pattern,
but you can set any index pattern as the default. The default index pattern is automatically selected when you first open <<discover,*Discover*>> or create a visualization from scratch.
When you delete an index pattern, you are unable to recover the associated field formatters, scripted fields, source filters,
and field popularity data. Deleting an index pattern does not remove any indices or data documents from {es}.

. In *Index patterns*, click the index pattern name.
. Click the star icon (image:management/index-patterns/images/star.png[Star icon]).
WARNING: Deleting an index pattern breaks all visualizations, saved searches, and other saved objects that reference the index pattern.

[float]
[[delete-index-pattern]]
=== Delete an index pattern
. Open the main menu, then click *Stack Management > Index Patterns*.

This action removes the pattern from the list of saved objects in {kib}.
You will not be able to recover field formatters, scripted fields, source filters,
and field popularity data associated with the index pattern. Deleting an
index pattern does not remove any indices or data documents from {es}.
. Click the index pattern you want to delete.

WARNING: Deleting an index pattern breaks all visualizations, saved searches, and other saved objects that reference the pattern.

. In *Index patterns*, click the index pattern name.
. Click the delete icon (image:management/index-patterns/images/delete.png[Delete icon]).
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the index pattern.

[float]
[[reload-fields]]
=== What’s next

* Learn about <<scripted-fields,scripted fields>> and how to create data on the fly.
Learn how to <<managing-index-patterns,manage the data fields>> in your index patterns.
5 changes: 2 additions & 3 deletions docs/concepts/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,9 @@ that accesses the {kib} API.

{kib} uses the index pattern to show you a list of fields, such as
`event.duration`. You can customize the display name and format for each field.
For example, you can tell Kibana to display `event.duration` in seconds.
For example, you can tell {kib} to display `event.duration` in seconds.
{kib} has <<managing-fields,field formatters>> for strings,
dates, geopoints,
and numbers.
dates, geopoints, and numbers.

[float]
[[kibana-concepts-searching-your-data]]
Expand Down
Binary file modified docs/images/colorformatter.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
9 changes: 2 additions & 7 deletions docs/management/field-formatters/color-formatter.asciidoc
Original file line number Diff line number Diff line change
@@ -1,10 +1,5 @@
The `Color` field formatter enables you to specify colors with specific ranges of values for a numeric field.
The *Color* field formatter enables you to specify colors with ranges of values for a number field.

When you select the `Color` field formatter, Kibana displays the *Range*, *Font Color*, *Background Color*, and
*Example* fields.

Click the *Add Color* button to add a range of values to associate with a particular color. You can click in the *Font
Color* and *Background Color* fields to display a color picker. You can also enter a specific hex code value in the
field. The effect of your current color choices are displayed in the *Example* field.
When you select the *Color* formatter, click *Add Color*, then specify the *Range*, *Text color*, and *Background color*.

image::images/colorformatter.png[]
4 changes: 2 additions & 2 deletions docs/management/field-formatters/duration-formatter.asciidoc
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
The `Duration` field formatter can display the numeric value of a field in the following increments:
The *Duration* field formatter displays the numeric value of a field in the following increments:

* Picoseconds
* Nanoseconds
Expand All @@ -12,4 +12,4 @@ The `Duration` field formatter can display the numeric value of a field in the f
* Months
* Years
You can specify these increments with up to 20 decimal places for both input and output formats.
You can specify these increments with up to 20 decimal places for input and output formats.
15 changes: 12 additions & 3 deletions docs/management/field-formatters/string-formatter.asciidoc
Original file line number Diff line number Diff line change
@@ -1,11 +1,20 @@
The `String` field formatter can apply the following transformations to the field's contents:
The *String* field formatter enables you to apply transforms to the field.

Supported transformations include:

* Convert to lowercase
* Convert to uppercase
* Convert to title case
* Apply the short dots transformation, which replaces the content before a `.` character with the first character of
that content, as in the following example:
* Apply the short dots transformation, which replaces the content before the `.` character with the first character of
the content. For example:
[horizontal]
*Original*:: *Becomes*
`com.organizations.project.ClassName`:: `c.o.p.ClassName`

* Base64 decode
* URL param decode
27 changes: 13 additions & 14 deletions docs/management/field-formatters/url-formatter.asciidoc
Original file line number Diff line number Diff line change
@@ -1,33 +1,32 @@
The `Url` field formatter can take on the following types:
You can specify the following types to the `Url` field formatter:

* The *Link* type turn the contents of the field into an URL.
* The *Image* type can be used to specify an image directory where a specified image is located.
* The *Audio* type can be used to specify an audio directory where a specified audio file is located.
* *Link* &mdash; Converts the contents of the field into an URL. You can specify the width and height of the image, while keeping the aspect ratio.
When the image is smaller than the specified paramters, the image is unable to upscale.
* *Image* &mdash; Specifies the image directory.
* *Audio* &mdash; Specify the audio directory.
For an *Image* type you can specify width and height attributes. These will be used to set the max width / max height of the image, while keeping the aspect ratio. Image will not be upscaled if it's smaller than the provided size parameters.

You can customize either type of URL field formats with templates. A _URL template_ enables you to add specific values
to a partial URL. Use the string `{{value}}` to add the contents of the field to a fixed URL.
To customize URL field formats, use templates. An *URL template* enables you to add values
to a partial URL. To add the contents of the field to a fixed URL, use the `{{value}}` string.

For example, when:

* A field contains a user ID
* That field uses the `Url` field formatter
* A field uses the `Url` field formatter
* The URI template is `http://company.net/profiles?user_id={­{value}­}`
The resulting URL replaces `{{value}}` with the user ID from the field.

The `{{value}}` template string URL-encodes the contents of the field. When a field encoded into a URL contains
non-ASCII characters, these characters are replaced with a `%` character and the appropriate hexadecimal code. For
non-ASCII characters, the characters are replaced with a `%` character and the appropriate hexadecimal code. For
example, field contents `users/admin` result in the URL template adding `users%2Fadmin`.

When the formatter type is set to *Image*, the `{{value}}` template string specifies the name of an image at the
When the formatter type is *Image*, the `{{value}}` template string specifies the name of an image at the
specified URI.

When the formatter type is set to *Audio*, the `{{value}}` template string specifies the name of an audio file at the specified URI.
When the formatter type is *Audio*, the `{{value}}` template string specifies the name of an audio file at the specified URI.

In order to pass unescaped values directly to the URL, use the `{{rawValue}}` string.
To pass unescaped values directly to the URL, use the `{{rawValue}}` string.

A _Label Template_ enables you to specify a text string that displays instead of the raw URL. You can use the
A *Label template* enables you to specify a text string that appears instead of the raw URL. You can use the
`{{value}}` template string normally in label templates. You can also use the `{{url}}` template string to display
the formatted URL.
Loading

0 comments on commit 7bf11e9

Please sign in to comment.