仅获取字段的 ZE83AED3DDF4667DEC0DAAAACB2BB3BE0BZ 的 Kibana 饼图

Question

I'm trying to create a pie chart visualization that should take only a part of a field value. Here I have a field called "Version" whose values can be in the form "1.2.3.4" . Now I want the pie chart to pick only the first two characters of the field value irrespective of the third and fourth character [For example: "1.2.xx"] and display.

For example: If I have the versions as below: "Version": "1.0.0.0", "Version": "1.0.0.1", "Version": "1.1.0.0", "Version": "2.0.0.0"

Then the pie chart must split series into three parts with values as "1.0.xx", "1.1.xx", "2.0.xx", Where "1.0.xx" will occupy 50% of chart as two documents are present["1.0.0.0","1.0.0.1"].

Answer 1

By creating a new runtime field, which will remove the 3rd and 4th characters, you can use that field in the Pie chart.

This is an example of that runtime field (of type keyword):

emit(doc['Version'].value.splitOnToken(".")[0] + "." + doc['Version'].value.splitOnToken(".")[1])

Add runtime field to index pattern in kibana