With scripted fields in Kibana, we can create new fields not originally indexed in Elasticsearch that are computed at query time and added as a new field to the resulting documents. In this hands-on lab, we will explore the capabilities of scripted fields in Kibana by creating and visualizing some of our own.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create and Save the kilobytes Scripted Field for the Logs Index Pattern
- Create a new scripted field called kilobytes for the
logsindex pattern. - Divide the value of the
bytesfield by 1024 to calculate the value for the scripted field. - Save the field.
- Create a new scripted field called kilobytes for the
- Create and Save the flight Scripted Field for the Flights Index Pattern
- Create a new scripted field called flight for the
flightsindex pattern. - Concatenate a combination of static strings and the fields
FlightNum,OriginAirportID, andDestAirportIDto produce values that look like FlightFlightNum:OriginAirportIDtoDestAirportID(for example: Flight 3CG21F9: EZE to SHA). - Save the field.
- Create a new scripted field called flight for the
- Create and Save the system.memory.buffercache.pct Scripted Field for the metricbeat-* Index Pattern
- Create a new scripted field called system.memory.buffercache.pct for the
metricbeat-*index pattern. - Subtract the value of
system.memory.actual.used.pctfromsystem.memory.used.pctonly if both fields do not have a size of 0 (otherwise known as a null value). - Format the scripted field as a percentage number.
- Save the field.
- Create a new scripted field called system.memory.buffercache.pct for the
