Format data view fields

Kibana uses the same field types as Elasticsearch, however, some Elasticsearch field types are unsupported in Kibana. To customize how Kibana displays data view fields, use the formatting options.

1. Go to the Data Views management page using the navigation menu or the global search field.
2. Select the data view that contains the field you want to change.
3. Find the field, then open the edit options ().
4. Select Set custom label, then enter a Custom label for the field.
5. Select Set format, then enter the Format for the field.

String fields support the String and Url formatters.

Date fields support the Date, String, and Url formatters.

The Date formatter enables you to choose the display format of date stamps using the moment.js standard format definitions.

Geographic point fields support the String formatter.

Numeric fields support the Bytes and Bits, Color, Duration, Histogram, Number, Percentage, String, and Url formatters.

The Bytes and Bits, Number, and Percentage formatters enable you to choose the display formats of numbers in the field using the Elastic numeral pattern syntax that Kibana maintains.

The Histogram formatter is used only for the histogram field type. When you use the Histogram formatter, you can apply the Bytes and Bits, Number, or Percentage format to aggregated data.

The Duration field formatter displays the numeric value of a field in the following increments:

• Picoseconds
• Nanoseconds
• Microseconds
• Milliseconds
• Seconds
• Minutes
• Hours
• Days
• Weeks
• Months
• Years

You can specify these increments with up to 20 decimal places for input and output formats.

The Color field formatter enables you to specify colors with ranges of values for a number field.

When you select the Color formatter, select Add Color, then specify the Range, Text color, and Background color.

The String field formatter enables you to apply transforms to any field that supports it.

Supported transformations include:

• Convert to lowercase
• Convert to uppercase
• Convert to title case
• Apply the short dots transformation, which replaces the content before the . character with the first character of the content. For example:

Original

Becomes

com.organizations.project.ClassName

c.o.p.ClassName

• Base64 decode
• URL param decode

The Url field formatter enables you to convert the contents of any field that supports it into a link, image, or audio reference.

You can specify the following types to the Url field formatter:

• Link — Converts the contents of the field into an URL. You can specify the width and height of the image, while keeping the aspect ratio. When the image is smaller than the specified parameters, the image is unable to upscale.
• Image — Specifies the image directory.
• Audio — Specify the audio directory.

To customize URL field formats, use templates. An URL template enables you to add values to a partial URL. To add the contents of the field to a fixed URL, use the {{value}} string.

For example, when:

• A field contains a user ID
• A field uses the Url field formatter
• The URI template is http://company.net/profiles?user_id={­{{value}}­}

The resulting URL replaces {{value}} with the user ID from the field.

The {{value}} template string URL-encodes the contents of the field. When a field encoded into a URL contains non-ASCII characters, the characters are replaced with a % character and the appropriate hexadecimal code. For example, field contents users/admin result in the URL template adding users%2Fadmin.

When the formatter type is Image, the {{value}} template string specifies the name of an image at the specified URI.

You can render base64 images from data within a document by using the following URL template:

data:image/png;base64,{{value}}
		

For example:

This configuration renders a PNG file in Discover as follows:

When the formatter type is Audio, the {{value}} template string specifies the name of an audio file at the specified URI.

To pass values directly to the URL without encoding them, use the {{rawValue}} string.

A Label template enables you to specify a text string that appears instead of the raw URL. You can use the {{value}} template string normally in label templates. You can also use the {{url}} template string to display the formatted URL.

• Data views
• Customize data view fields