When I create a pie chart, I want to substitute all empty values of a field myfield
(i.e. equal to ""
) by "Others"
. How can I do it in Kibana?
If it's impossible to do in Kibana, then how can I do it using Elasticsearch.
UPDATE:
I executed this query and it didn't give me any error:
GET myindex/entry/_update_by_query
{
"query":{
"term": {
"myfield.keyword": {
"value": ""
}
}
},
"script":{
"inline": "ctx._source.myfield = 'Other'",
"lang": "painless"
}
}
I get this output:
{
"took": 5,
"timed_out": false,
"total": 0,
"updated": 0,
"deleted": 0,
"batches": 0,
"version_conflicts": 0,
"noops": 0,
"retries": {
"bulk": 0,
"search": 0
},
"throttled_millis": 0,
"requests_per_second": -1,
"throttled_until_millis": 0,
"failures": []
}
But when I check the values of myfield
, I get the value ""
again, instead of Other
.
GET myindex/_search?
{
"size":0,
"aggs": {
"months": {
"terms" : {
"field": "myfield"
}
}
}
}
This is my index mapping:
PUT /myindex
{
"mappings": {
"entry": {
"_all": {
"enabled": false
},
"properties": {
"Id": {
"type":"keyword"
},
"Country": {
"type":"keyword"
},
"myfield": {
"type":"keyword"
},
"Year": {
"type":"integer"
},
"Counter": {
"type":"integer"
}
}
}
}
}
As far as I know, this cannot be done at Kibana's end. You can update all your empty field documents with "Others" in Elasticsearch index.
To update on Elasticsearch end, you can use Update By Query API. Below is the update code/query.
GET myindex/entry/_update_by_query
{
"query":{
"term": {
"myfield": {
"value": ""
}
}
},
"script":{
"inline": "ctx._source.myfield = 'Other'",
"lang": "painless"
}
}
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments