Skip to content

Instantly share code, notes, and snippets.

View ijokarumawak's full-sized avatar

Koji Kawamura ijokarumawak

View GitHub Profile
ijokarumawak /
Last active August 31, 2023 04:56
AdVEGAnt Calendar - A Vega visualization example to create Kibana filter

AdVEGAnt Calendar


This example dashboard contains a Vega visualization, which renders a Christmas tree! When each node in the tree is clicked, a corresponding Kibana filter is created, so that the advent calendar blog post can be seen on the TSVB Markdown on the right hand side.

I was planning to write a post for Japanese Elastic Stack (Elasticsearch) Advent Calendar 2022, but every slot is filled. Nice! So I'm sharing it here... :)

"$schema": "",
"description": "A basic bar chart example, with value labels shown upon mouse hover.",
"data": [
"name": "table",
"values": [
{"name": "A", "current": 28, "upper": 80, "lower": 20},
{"name": "B", "current": 55, "upper": 70, "lower": 30},
{"name": "C", "current": 43, "upper": 60, "lower": 20},
ijokarumawak /
Last active November 8, 2022 06:34
A simple Logstash example.

Simple Logstash example

  • Load CSV data
  • Apply some filters
  • Changing index name besed on value

How to run

Clone this Gist on your host.

ijokarumawak /
Last active June 15, 2022 09:34
Use Logstash ruby filter to rename field name based on value type to avoid Elasticsearch mapping conflict

This is Logstash ruby filter example to rename field names within a specified hash, based on each value type. The original question was asked at this Elastic Discuss.

How to test the filter

With -t, the filter can be tested:

logstash -e "filter { ruby { path => '/{path_of_the_ruby_script}/rename_by_data_type.rb' script_params => { 'field' => 'the_name_of_target_field' } } }" -t


ijokarumawak / 0.Runtime Field Dashboard
Last active April 12, 2022 05:54
Runtime Field を利用した Kibana ダッシュボードサンプル

Runtime Field を利用した Kibana ダッシュボードサンプル

"socks_a" のように、カテゴリ名_会社名という値を Runtime field を使い、カテゴリ名、会社名と別々のフィールドとして扱うサンプル。

# 1. サンプルデータの登録
POST items-sample/_bulk
{"index": {}}
{"index": {}}
ijokarumawak /
Last active March 11, 2022 09:37
A stored Painless script example for Elasticsearch Ingest node pipeline to extract certain time unit from a timestamp value.
# Create a stored script
PUT _scripts/getTimestampUnitValue
  "script": {
    "lang": "painless", 
    "source": """
    def value = ctx[params['field']];
    if (value == null) {
ijokarumawak / Query timestamp only by
Created December 15, 2021 03:10
A runtime field example at query time.
GET blogs/_search
  "runtime_mappings": {
    "publish_hour": {
      "type": "long",
      "script": {
        "source": "emit(doc['publish_date'].value.hour)"
ijokarumawak /
Last active October 19, 2021 02:13
Show multiple metrics in the same Kibana Lens chart

Show two metrics using different chart styles.

  • Use two layers, line chart and bar chart
  • Use the same x-axis among the two layers, order_date date histogram in this example
  • Use different colors
  • Separate y-axis

How to test Beats processors

To test Beats processors, beats playground can be helpful.


2019-09-29 STATUS_OK Server started normally. 92ms
2019-09-30 STATUS_OK Server started normally. 120ms
2019-10-01 STATUS_NG Server stopped abnormally. Timed out. 3010ms
ijokarumawak /
Created July 26, 2021 08:43
EQL example.

Set up a Data Stream

# Delete the stream in order to clear old data
DELETE _data_stream/my-event-stream

# Define a template
PUT /_index_template/my-event-stream-template
  "index_patterns": [