Docs
Kibana User Guide [5.1] » Management » Managing Fields » Scripted Fields
«  Numeric Field Formatters     Setting Advanced Options  »

Scripted Fieldsedit

Scripted fields compute data on the fly from the data in your Elasticsearch indices. Scripted field data is shown on the Discover tab as part of the document data, and you can use scripted fields in your visualizations. Scripted field values are computed at query time so they aren’t indexed and cannot be searched.

Note

Kibana cannot query scripted fields.

Warning

Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on Kibana’s performance. Keep in mind that there’s no built-in validation of a scripted field. If your scripts are buggy, you’ll get exceptions whenever you try to view the dynamically generated data.

Scripted fields use the Lucene expression syntax. For more information, see Lucene Expressions Scripts.

You can reference any single value numeric field in your expressions, for example:

doc['field_name'].value

Creating a Scripted Fieldedit

To create a scripted field:

  1. Go to Settings > Indices
  2. Select the index pattern you want to add a scripted field to.
  3. Go to the pattern’s Scripted Fields tab.
  4. Click Add Scripted Field.
  5. Enter a name for the scripted field.
  6. Enter the expression that you want to use to compute a value on the fly from your index data.
  7. Click Save Scripted Field.

For more information about scripted fields in Elasticsearch, see Scripting.

Note

In Elasticsearch releases 1.4.3 and later, this functionality requires you to enable dynamic Groovy scripting.

Updating a Scripted Fieldedit

To modify a scripted field:

  1. Go to Settings > Indices
  2. Click the Edit button for the scripted field you want to change.
  3. Make your changes and then click Save Scripted Field to update the field.
Warning

Keep in mind that there’s no built-in validation of a scripted field. If your scripts are buggy, you’ll get exceptions whenever you try to view the dynamically generated data.

Deleting a Scripted Fieldedit

To delete a scripted field:

  1. Go to Settings > Indices
  2. Click the Delete button for the scripted field you want to remove.
  3. Confirm that you really want to delete the field.
«  Numeric Field Formatters     Setting Advanced Options  »