[Saved Search] Combine Saved Search/Data Table

[Erikg346]

[Saved Search] Combine Saved Search/Data Table

[stratoula]

Hey @Erikg346. I will need some help to understand the issues you encounter. I am not sure I follow 100%. So you want to visualize raw documents but you want to change the name of the columns, do I understand correctly? If yes you have 2 options:

Dataview mode

1. Click the field you want to rename in the sidebar

2. Click the Edit icon
3. Change the custom label to the name you want to give

4. Save and you will see that the header has changed

ES|QL mode
In case you operate in a kibana version > 8.11 then you can also accomplish that with ES|QL.

1. Click the data view picker and select the Try ES|QL green button

2. Change the query to

from kibana_sample_data_logs | rename index as `custom_label`

3. The field has been renamed to the name you want.

If this is not what you want then can you please help me understand better what you are trying to accomplish? Thanx a ton

[Erikg346]

Hey @stratoula

So, clarification: @timestamp can be added to ESQL searches; the issue I experienced is that once I added the @timestamp to the search, it didn't allow me to move it to the left (where @timestamp normally is). I tried it again, and I believe it's an issue with version 8.12.2.

8.12.2

Recording.2024-06-10.112426.mp4

8.14.0
Working as expected:

[stratoula]

Ah yes this was a bug that got fixed in 8.13 if I am not mistaken. I hope you enjoy esql and please feel free to send us your feedback! Also if with esql you can accomplish what you want maybe we can close this issue or is anything missing that you would like us to take under consideration?

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[Erikg346]

Hey @stratoula,

1. Data View
   yes, so the issue with changing the data view is our fields can be used to convey different information within one data view.

For example, If we change 'host.name' to 'Elastic Servers', anything that is not an Elastic Server will be labeled as such.
So if I wanted to see 'host.name' as 'Azure VMs', it will appear as 'Elastic Servers'.

2. ESQL
   As for the ESQL, the rename is a perfect alternative BUT for some reason, I can't display @timestamp. It seems like I want a data table (allows you to rename the column) but also keep the saved search format where you can see each document with their associated @timestamp.

Hopefully, that helps you understand a bit more.

[stratoula]

Gotcha! Yes unfortunately for dataview mode in order to have different names you need to create different dataviews.

About ESQL and the @timestamp this is weird. Do you have @timestamp in your index or is named differently. If yes, which version are you running?

[Erikg346]

All good thanks!