在 kibana 中添加新的自定义字段

Question

Is there a way to add a new field to all the documents in a index in kibana? For example, lets assume, i have the age of all the users in my elastic kibana. And i want to separate them into two categories as Below 50 and Above 50 . So if there is a user who is 23 years of age, he should have a category value as Below 50 .

Answer 1

Yes, you can. What you want is update-by-query and painless-scripts .

They will give you flexibility to do something of this sort

POST /users/string/_update_by_query
{
"script": "ctx._source.category = ctx._source.age > 50 ? "Above 50" : "Below 50"
}

Answer 2

I'd like to add another option to the one offered by @dravit. If you don't want to modify your documents, and you only need that extra field to run analysis in Kibana, you can add a scripted field to your index pattern, so that the category value is calculated at query time.

Ref: https://www.elastic.co/guide/en/kibana/current/scripted-fields.html

The script for your scripted field would be something as easy as

doc['age'].value > 50 ? "Above 50" : "Below 50"