如何在Kibana数据表中按术语创建子计数列 [英] How to create sub-count column by term in Kibana datatable
问题描述
我试图根据Elasticsearch中的数据来自定义数据表.
I am try to customize the data table from the data in Elasticsearch.
假设我有一个字段"部门"，该字段可以是部门A"或部门B"或部门C"等. 但是我只能显示所有记录的总数，而不能通过使用Department字段获得小计的价值.
Suppose I got a field "Department" which can be "Dept A" or "Dept B" or "Dept C" etc... But I can only show the total count of all the records instead of getting sub-total value by using the department field.
请参阅下表:
仅总计"列是正确的. 我的任务是实现部门A"和其他部门"下的数字.
Only the column "Total" is correct. My task is to achieve the figure under "Dept A" and "Other Dept".
是否可以在指标"上应用任何过滤器?或其他任何方式?
Is there any filter which can apply on the Metric? Or any other ways to do it?
请告知您是否需要更多信息.
Please tell if you need further information.
更新------------------------------------------- ----
搜索后，我找到了解决方法:
After searching, I find a workaround to do it:
首先在Kibana中创建两个脚本化字段，如下所示:
First create two scripted fields in Kibana like the following:
脚本字段名称:sf_dept_A
郎:无痛
脚本:
if (doc["department"].value.equals("Dept A"))
return 1;
else
return 0;
脚本字段名称:sf_other_dept
郎:无痛
脚本:
if (doc["department"].value.equals("Dept A") == false)
return 1;
else
return 0;
在创建了以上两个脚本字段之后，创建一个数据表，只需添加脚本字段总和的mertics，
After create the above two scripted fields, go to create a datatable, just add mertics of the sum of scripted fields,
添加指标
-
汇总:总和
Aggregation: Sum
字段:sf_dept_A
Field: sf_dept_A
自定义标签:部门A
添加指标
- 汇总:总和
- 字段:sf_dept_A
- 自定义标签:A部门
添加指标
- 汇总:计数
- 自定义标签:总计
通过这种方式，不同部门的数量可以按列分开. 但这需要更多的资源，如果我有很多部门，我必须创建许多字段.
In this way, the count of different departments can be separated by columns. But this should require much more resources and I have to create many fields if I have many departments.
推荐答案
在Kibana的最新版本中，您可以使用"JSON输入"在给定的可视化条件下即时执行此操作，而无需编写脚本字段:
In recent versions of Kibana, you can use the "JSON Input" to do this on-the-fly, in a given Visualization, without needing to scripted fields:
- 在可视化中，创建一个求和"指标(我认为在任何字段上，该字段实际上最终都会被忽略...?)
- 在该总和指标下，单击高级"链接，显示"JSON输入"文本框
- 在该文本框中，输入类似以下内容的内容:
{ "script": { "inline": "doc['SomeField'].value == 'SomeValue' ? 1 : 0", "lang": "painless" } }
- In your Visualization, create a "Sum" metric (on any field, I think - the field actually gets ignored in the end...?)
- Under that Sum Metric, click the "Advanced" link, revealing the "JSON Input" textbox
- In that textbox, type something like:
{ "script": { "inline": "doc['SomeField'].value == 'SomeValue' ? 1 : 0", "lang": "painless" } }
就在那里！您现在有了一个条件计数指标.默认标签为总和((无论您选择哪个字段)")，因此您需要在指标上设置更准确的自定义标签，例如"Count(SomeValue)".
And there you have it! You now have a conditional count metric. The default label will be "Sum of (whatever field you selected)", so you'll want to set a more accurate custom label on the metric, like "Count (SomeValue)".
这仍然会运行缓慢/昂贵，但据我所知，与您在问题中附加的解决方案相比，它有两个优点:
This will still be slow/expensive to run, but as I understand it there are a couple of advantage over the solution you've appended in your question:
- 您不需要预先创建所有这些脚本字段，可以在需要时根据实际需要定义脚本
- 创建脚本字段会在许多(所有?)查询上带来查询执行时间的开销，而只有当您运行此特定的可视化效果时，这种方法才具有开销.
这篇关于如何在Kibana数据表中按术语创建子计数列的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
