Canvas function reference
editCanvas function reference
editBehind the scenes, Canvas is driven by a powerful expression language, with dozens of functions and other capabilities, including table transforms, type casting, and sub-expressions.
The Canvas expression language also supports TinyMath functions, which perform complex math calculations.
A * denotes a required argument.
A † denotes an argument can be passed multiple times.
A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z
A
editall
editReturns true
if all of the conditions are met. See also any
.
Expression syntax
all {neq "foo"} {neq "bar"} {neq "fizz"} all condition={gt 10} condition={lt 20}
Code example
filters | demodata | math "mean(percent_uptime)" | formatnumber "0.0%" | metric "Average uptime" metricFont={ font size=48 family="'Open Sans', Helvetica, Arial, sans-serif" color={ if {all {gte 0} {lt 0.8}} then="red" else="green" } align="center" lHeight=48 } | render
This sets the color of the metric text to "red"
if the context passed into metric
is greater than or equal to 0 and less than 0.8. Otherwise, the color is set to "green"
.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed * † Alias: |
|
The conditions to check. |
Returns: boolean
alterColumn
editConverts between core types, including string
, number
, null
, boolean
, and date
, and renames columns. See also mapColumn
and staticColumn
.
Expression syntax
alterColumn "cost" type="string" alterColumn column="@timestamp" name="foo"
Code example
filters | demodata | alterColumn "time" name="time_in_ms" type="number" | table | render
This renames the time
column to time_in_ms
and converts the type of the column’s values from date
to number
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The name of the column to alter. |
|
|
The resultant column name. Leave blank to not rename. |
|
|
The type to convert the column to. Leave blank to not change the type. |
Returns: datatable
any
editReturns true
if at least one of the conditions is met. See also all
.
Expression syntax
any {eq "foo"} {eq "bar"} {eq "fizz"} any condition={lte 10} condition={gt 30}
Code example
filters | demodata | filterrows { getCell "project" | any {eq "elasticsearch"} {eq "kibana"} {eq "x-pack"} } | pointseries color="project" size="max(price)" | pie | render
This filters out any rows that don’t contain "elasticsearch"
, "kibana"
or "x-pack"
in the project
field.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed * † Alias: |
|
The conditions to check. |
Returns: boolean
as
editCreates a datatable
with a single value. See also getCell
.
Expression syntax
as as "foo" as name="bar"
Code example
filters | demodata | ply by="project" fn={math "count(username)" | as "num_users"} fn={math "mean(price)" | as "price"} | pointseries x="project" y="num_users" size="price" color="project" | plot | render
as
casts any primitive value (string
, number
, date
, null
) into a datatable
with a single row and a single column with the given name (or defaults to "value"
if no name is provided). This is useful when piping a primitive value into a function that only takes datatable
as an input.
In the example, ply
expects each fn
subexpression to return a datatable
in order to merge the results of each fn
back into a datatable
, but using a math
aggregation in the subexpressions returns a single math
value, which is then cast into a datatable
using as
.
Accepts: string
, boolean
, number
, null
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The name to give the column. Default: |
Returns: datatable
asset
editRetrieves Canvas workpad asset objects to provide as argument values. Usually images.
Expression syntax
asset "asset-52f14f2b-fee6-4072-92e8-cd2642665d02" asset id="asset-498f7429-4d56-42a2-a7e4-8bf08d98d114"
Code example
image dataurl={asset "asset-c661a7cc-11be-45a1-a401-d7592ea7917a"} mode="contain" | render
The image asset stored with the ID "asset-c661a7cc-11be-45a1-a401-d7592ea7917a"
is passed into the dataurl
argument of the image
function to display the stored asset.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The ID of the asset to retrieve. |
Returns: string
axisConfig
editConfigures the axis of a visualization. Only used with plot
.
Expression syntax
axisConfig show=false axisConfig position="right" min=0 max=10 tickSize=1
Code example
filters | demodata | pointseries x="size(cost)" y="project" color="project" | plot defaultStyle={seriesStyle bars=0.75 horizontalBars=true} legend=false xaxis={axisConfig position="top" min=0 max=400 tickSize=100} yaxis={axisConfig position="right"} | render
This sets the x-axis
to display on the top of the chart and sets the range of values to 0-400
with ticks displayed at 100
intervals. The y-axis
is configured to display on the right
.
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
The maximum value displayed in the axis. Must be a number, a date in milliseconds since epoch, or an ISO8601 string. |
|
|
The minimum value displayed in the axis. Must be a number, a date in milliseconds since epoch, or an ISO8601 string. |
|
|
The position of the axis labels. For example, Default: |
|
|
Show the axis labels? Default: |
|
|
The increment size between each tick. Use for |
Returns: axisConfig
C
editcase
editBuilds a case
, including a condition and a result, to pass to the switch
function.
Expression syntax
case 0 then="red" case when=5 then="yellow" case if={lte 50} then="green"
Code example
math "random()" | progress shape="gauge" label={formatnumber "0%"} font={ font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" align="center" color={ switch {case if={lte 0.5} then="green"} {case if={all {gt 0.5} {lte 0.75}} then="orange"} default="red" } } valueColor={ switch {case if={lte 0.5} then="green"} {case if={all {gt 0.5} {lte 0.75}} then="orange"} default="red" } | render
This sets the color of the progress indicator and the color of the label to "green"
if the value is less than or equal to 0.5
, "orange"
if the value is greater than 0.5
and less than or equal to 0.75
, and "red"
if none
of the case conditions are met.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The value compared to the context to see if they are equal. The |
|
|
This value indicates whether the condition is met. The |
|
|
The value returned if the condition is met. |
Returns: case
clear
editClears the context, and returns null
.
Accepts: null
Returns: null
clog
editIt outputs the context in the console. This function is for debug purpose.
Expression syntax
clog
Code example
filters | demodata | clog | filterrows fn={getCell "age" | gt 70} | clog | pointseries x="time" y="mean(price)" | plot defaultStyle={seriesStyle lines=1 fill=1} | render
This prints the datatable
objects in the browser console before and after the filterrows
function.
Accepts: any
Returns: any
columns
editIncludes or excludes columns from a datatable
. When both arguments are specified, the excluded columns will be removed first.
Expression syntax
columns include="@timestamp, projects, cost" columns exclude="username, country, age"
Code example
filters | demodata | columns include="price, cost, state, project" | table | render
This only keeps the price
, cost
, state
, and project
columns from the demodata
data source and removes all other columns.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
A comma-separated list of column names to keep in the |
|
|
A comma-separated list of column names to remove from the |
Returns: datatable
compare
editCompares the context to specified value to determine true
or false
. Usually used in combination with <<if_fn>>
or case
. This only works with primitive types, such as number
, string
, boolean
, null
. See also eq
, gt
, gte
, lt
, lte
, neq
Expression syntax
compare "neq" to="elasticsearch" compare op="lte" to=100
Code example
filters | demodata | mapColumn project fn={getCell project | switch {case if={compare eq to=kibana} then=kibana} {case if={compare eq to=elasticsearch} then=elasticsearch} default="other" } | pointseries size="size(cost)" color="project" | pie | render
This maps all project
values that aren’t "kibana"
and "elasticsearch"
to "other"
. Alternatively, you can use the individual comparator functions instead of compare.
Accepts: string
, number
, boolean
, null
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The operator to use in the comparison: Default: |
Aliases: |
|
The value compared to the context. |
Returns: boolean
containerStyle
editCreates an object used for styling an element’s container, including background, border, and opacity.
Expression syntax
containerStyle backgroundColor="red"’ containerStyle borderRadius="50px" containerStyle border="1px solid black" containerStyle padding="5px" containerStyle opacity="0.5" containerStyle overflow="hidden" containerStyle backgroundImage={asset id=asset-f40d2292-cf9e-4f2c-8c6f-a504a25e949c} backgroundRepeat="no-repeat" backgroundSize="cover"
Code example
shape "star" fill="#E61D35" maintainAspect=true | render containerStyle={ containerStyle backgroundColor="#F8D546" borderRadius="200px" border="4px solid #05509F" padding="0px" opacity="0.9" overflow="hidden" }
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
A valid CSS background color. |
|
|
A valid CSS background image. |
|
|
A valid CSS background repeat. Default: |
|
|
A valid CSS background size. Default: |
|
|
A valid CSS border. |
|
|
The number of pixels to use when rounding the corners. |
|
|
A number between 0 and 1 that represents the degree of transparency of the element. |
|
|
A valid CSS overflow. Default: |
|
|
The distance of the content, in pixels, from the border. |
Returns: containerStyle
context
editReturns whatever you pass into it. This can be useful when you need to use context as argument to a function as a sub-expression.
Expression syntax
context
Code example
date | formatdate "LLLL" | markdown "Last updated: " {context} | render
Using the context
function allows us to pass the output, or context, of the previous function as a value to an argument in the next function. Here we get the formatted date string from the previous function and pass it as content
for the markdown element.
Accepts: any
Returns: Depends on your input and arguments
csv
editCreates a datatable
from CSV input.
Expression syntax
csv "fruit, stock kiwi, 10 Banana, 5"
Code example
csv "fruit,stock kiwi,10 banana,5" | pointseries color=fruit size=stock | pie | render
This creates a datatable
with fruit
and stock
columns with two rows. This is useful for quickly mocking data.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The CSV data to use. |
|
|
The data separation character. |
|
|
The row separation character. |
Returns: datatable
D
editdate
editReturns the current time, or a time parsed from a specified string, as milliseconds since epoch.
Expression syntax
date date value=1558735195 date "2019-05-24T21:59:55+0000" date "01/31/2019" format="MM/DD/YYYY"
Code example
date | formatdate "LLL" | markdown {context} font={font family="Arial, sans-serif" size=30 align="left" color="#000000" weight="normal" underline=false italic=false} | render
Using date
without passing any arguments will return the current date and time.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
An optional date string that is parsed into milliseconds since epoch. The date string can be either a valid JavaScript |
|
|
The MomentJS format used to parse the specified date string. For more information, see https://momentjs.com/docs/#/displaying/. |
Returns: number
demodata
editA sample data set that includes project CI times with usernames, countries, and run phases.
Expression syntax
demodata demodata "ci" demodata type="shirts"
Code example
filters | demodata | table | render
demodata
is a mock data set that you can use to start playing around in Canvas.
Accepts: filter
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The name of the demo data set to use. Default: |
Returns: datatable
do
editExecutes multiple sub-expressions, then returns the original context. Use for running functions that produce an action or a side effect without changing the original context.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed † Aliases: |
|
The sub-expressions to execute. The return values of these sub-expressions are not available in the root pipeline as this function simply returns the original context. |
Returns: Depends on your input and arguments
dropdownControl
editConfigures a dropdown filter control element.
Expression syntax
dropdownControl valueColumn=project filterColumn=project dropdownControl valueColumn=agent filterColumn=agent.keyword filterGroup=group1
Code example
demodata | dropdownControl valueColumn=project filterColumn=project | render
This creates a dropdown filter element. It requires a data source and uses the unique values from the given valueColumn
(i.e. project
) and applies the filter to the project
column. Note: filterColumn
should point to a keyword type field for Elasticsearch data sources.
Accepts: datatable
Argument | Type | Description |
---|---|---|
|
|
The column or field that you want to filter. |
|
|
The group name for the filter. |
|
|
The column or field from which to extract the unique values for the dropdown control. |
Returns: render
E
editeq
editReturns whether the context is equal to the argument.
Expression syntax
eq true eq null eq 10 eq "foo"
Code example
filters | demodata | mapColumn project fn={getCell project | switch {case if={eq kibana} then=kibana} {case if={eq elasticsearch} then=elasticsearch} default="other" } | pointseries size="size(cost)" color="project" | pie | render
This changes all values in the project column that don’t equal "kibana"
or "elasticsearch"
to "other"
.
Accepts: boolean
, number
, string
, null
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
escount
editQuery Elasticsearch for the number of hits matching the specified query.
Expression syntax
escount index="logstash-*" escount "currency:"EUR"" index="kibana_sample_data_ecommerce" escount query="response:404" index="kibana_sample_data_logs"
Code example
filters | escount "Cancelled:true" index="kibana_sample_data_flights" | math "value" | progress shape="semicircle" label={formatnumber 0,0} font={font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align=center} max={filters | escount index="kibana_sample_data_flights"} | render
The first escount
expression retrieves the number of flights that were cancelled. The second escount
expression retrieves the total number of flights.
Accepts: filter
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
A Lucene query string. Default: |
|
|
An index or index pattern. For example, Default: |
Returns: number
esdocs
editQuery Elasticsearch for raw documents. Specify the fields you want to retrieve, especially if you are asking for a lot of rows.
Expression syntax
esdocs index="logstash-*" esdocs "currency:"EUR"" index="kibana_sample_data_ecommerce" esdocs query="response:404" index="kibana_sample_data_logs" esdocs index="kibana_sample_data_flights" count=100 esdocs index="kibana_sample_data_flights" sort="AvgTicketPrice, asc"
Code example
filters | esdocs index="kibana_sample_data_ecommerce" fields="customer_gender, taxful_total_price, order_date" sort="order_date, asc" count=10000 | mapColumn "order_date" fn={getCell "order_date" | date {context} | rounddate "YYYY-MM-DD"} | alterColumn "order_date" type="date" | pointseries x="order_date" y="sum(taxful_total_price)" color="customer_gender" | plot defaultStyle={seriesStyle lines=3} palette={palette "#7ECAE3" "#003A4D" gradient=true} | render
This retrieves the first 10000 documents data from the kibana_sample_data_ecommerce
index sorted by order_date
in ascending order, and only requests the customer_gender
, taxful_total_price
, and order_date
fields.
Accepts: filter
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
A Lucene query string. Default: |
|
|
The number of documents to retrieve. For better performance, use a smaller data set. Default: |
|
|
A comma-separated list of fields. For better performance, use fewer fields. |
|
|
An index or index pattern. For example, Default: |
|
|
Comma separated list of meta fields. For example, |
|
|
The sort direction formatted as |
Returns: datatable
essql
editQueries Elasticsearch using Elasticsearch SQL.
Expression syntax
essql query="SELECT * FROM "logstash*"" essql "SELECT * FROM "apm*"" count=10000
Code example
filters | essql query="SELECT Carrier, FlightDelayMin, AvgTicketPrice FROM "kibana_sample_data_flights"" | table | render
This retrieves the Carrier
, FlightDelayMin
, and AvgTicketPrice
fields from the "kibana_sample_data_flights" index.
Accepts: filter
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
An Elasticsearch SQL query. |
|
|
The number of documents to retrieve. For better performance, use a smaller data set. Default: |
Alias: |
|
The timezone to use for date operations. Valid ISO8601 formats and UTC offsets both work. Default: |
Returns: datatable
exactly
editCreates a filter that matches a given column to an exact value.
Expression syntax
exactly "state" value="running" exactly "age" value=50 filterGroup="group2" exactly column="project" value="beats"
Code example
filters | exactly column=project value=elasticsearch | demodata | pointseries x=project y="mean(age)" | plot defaultStyle={seriesStyle bars=1} | render
The exactly
filter here is added to existing filters retrieved by the filters
function and further filters down the data to only have "elasticsearch"
data. The exactly
filter only applies to this one specific element and will not affect other elements in the workpad.
Accepts: filter
Argument | Type | Description |
---|---|---|
Aliases: |
|
The column or field that you want to filter. |
|
|
The group name for the filter. |
Aliases: |
|
The value to match exactly, including white space and capitalization. |
Returns: filter
F
editfilterrows
editFilters rows in a datatable
based on the return value of a sub-expression.
Expression syntax
filterrows {getCell "project" | eq "kibana"} filterrows fn={getCell "age" | gt 50}
Code example
filters | demodata | filterrows {getCell "country" | any {eq "IN"} {eq "US"} {eq "CN"}} | mapColumn "@timestamp" fn={getCell "@timestamp" | rounddate "YYYY-MM"} | alterColumn "@timestamp" type="date" | pointseries x="@timestamp" y="mean(cost)" color="country" | plot defaultStyle={seriesStyle points="2" lines="1"} palette={palette "#01A4A4" "#CC6666" "#D0D102" "#616161" "#00A1CB" "#32742C" "#F18D05" "#113F8C" "#61AE24" "#D70060" gradient=false} | render
This uses filterrows
to only keep data from India (IN
), the United States (US
), and China (CN
).
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed * Aliases: |
|
An expression to pass into each row in the |
Returns: datatable
filters
editAggregates element filters from the workpad for use elsewhere, usually a data source.
Expression syntax
filters filters group="timefilter1" filters group="timefilter2" group="dropdownfilter1" ungrouped=true
Code example
filters group=group2 ungrouped=true | demodata | pointseries x="project" y="size(cost)" color="project" | plot defaultStyle={seriesStyle bars=0.75} legend=false font={ font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" align="left" color="#FFFFFF" weight="lighter" underline=true italic=true } | render
filters
sets the existing filters as context and accepts a group
parameter to opt into specific filter groups. Setting ungrouped
to true
opts out of using global filters.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed † Alias: |
|
The name of the filter group to use. |
Aliases: |
|
Exclude filters that belong to a filter group? Default: |
Returns: filter
font
editCreate a font style.
Expression syntax
font size=12 font family=Arial font align=middle font color=pink font weight=lighter font underline=true font italic=false font lHeight=32
Code example
filters | demodata | pointseries x="project" y="size(cost)" color="project" | plot defaultStyle={seriesStyle bars=0.75} legend=false font={ font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" align="left" color="#FFFFFF" weight="lighter" underline=true italic=true } | render
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
The horizontal text alignment. Default: |
|
|
The text color. |
|
|
An acceptable CSS web font string Default: |
|
|
Italicize the text? Default: |
Alias: |
|
The line height in pixels Default: |
|
|
The font size in pixels Default: |
|
|
Underline the text? Default: |
|
|
The font weight. For example, Default: |
Returns: style
formatdate
editFormats an ISO8601 date string or a date in milliseconds since epoch using MomentJS. See https://momentjs.com/docs/#/displaying/.
Expression syntax
formatdate format="YYYY-MM-DD" formatdate "MM/DD/YYYY"
Code example
filters | demodata | mapColumn "time" fn={getCell time | formatdate "MMM 'YY"} | pointseries x="time" y="sum(price)" color="state" | plot defaultStyle={seriesStyle points=5} | render
This transforms the dates in the time
field into strings that look like "Jan ‘19"
, "Feb ‘19"
, etc. using a MomentJS format.
Accepts: number
, string
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
A MomentJS format. For example, |
Returns: string
formatnumber
editFormats a number into a formatted number string using the Numeral pattern.
Expression syntax
formatnumber format="$0,0.00" formatnumber "0.0a"
Code example
filters | demodata | math "mean(percent_uptime)" | progress shape="gauge" label={formatnumber "0%"} font={font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center"} | render
The formatnumber
subexpression receives the same context
as the progress
function, which is the output of the math
function. It formats the value into a percentage.
Accepts: number
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
A Numeral pattern format string. For example, |
Returns: string
G
editgetCell
editFetches a single cell from a datatable
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
The name of the column to fetch the value from. If not provided, the value is retrieved from the first column. |
Alias: |
|
The row number, starting at 0. Default: |
Returns: Depends on your input and arguments
gt
editReturns whether the context is greater than the argument.
Accepts: number
, string
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
gte
editReturns whether the context is greater or equal to the argument.
Accepts: number
, string
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
H
edithead
editRetrieves the first N rows from the datatable
. See also tail
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The number of rows to retrieve from the beginning of the Default: |
Returns: datatable
I
editif
editPerforms conditional logic.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
A |
|
|
The return value when the condition is |
|
|
The return value when the condition is |
Returns: Depends on your input and arguments
image
editDisplays an image. Provide an image asset as a base64
data URL, or pass in a sub-expression.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
The HTTP(S) URL or Example value for the Unnamed argument, formatted as a |
|
|
Default: |
Returns: image
J
editjoinRows
editConcatenates values from rows in a datatable
into a single string.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The column or field from which to extract the values. |
|
|
Extract only unique values? Default: |
|
|
The quote character to wrap around each extracted value. Default: |
Aliases: |
|
The delimiter to insert between each extracted value. Default: |
Returns: string
L
editlocation
editFind your current location using the Geolocation API of the browser. Performance can vary, but is fairly accurate. See https://developer.mozilla.org/en-US/docs/Web/API/Navigator/geolocation. Don’t use location
if you plan to generate PDFs as this function requires user input.
Accepts: null
Returns: datatable
lt
editReturns whether the context is less than the argument.
Accepts: number
, string
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
lte
editReturns whether the context is less than or equal to the argument.
Accepts: number
, string
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
M
editmapCenter
editReturns an object with the center coordinates and zoom level of the map.
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
Latitude for the center of the map |
|
|
Longitude for the center of the map |
|
|
Zoom level of the map |
Returns: mapCenter
mapColumn
editAdds a column calculated as the result of other columns. Changes are made only when you provide arguments.See also alterColumn
and staticColumn
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed * Aliases: |
|
The name of the resulting column. |
Aliases: |
|
A Canvas expression that is passed to each row as a single row |
Returns: datatable
markdown
editAdds an element that renders Markdown text. TIP: Use the markdown
function for single numbers, metrics, and paragraphs of text.
Accepts: datatable
, null
Argument | Type | Description |
---|---|---|
Unnamed † Aliases: |
|
A string of text that contains Markdown. To concatenate, pass the Default: |
|
|
The CSS font properties for the content. For example, "font-family" or "font-weight". Default: |
|
|
A true or false value for opening links in a new tab. The default value is Default: |
Returns: render
math
editInterprets a TinyMath
math expression using a number
or datatable
as context. The datatable
columns are available by their column name. If the context is a number it is available as value
.
Accepts: number
, datatable
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
An evaluated |
Returns: number
metric
editDisplays a number over a label.
Accepts: number
, string
, null
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
The text describing the metric. Default: |
|
|
The CSS font properties for the label. For example, Default: |
|
|
The CSS font properties for the metric. For example, Default: |
Alias: |
|
A Numeral pattern format string. For example, |
Returns: render
N
editneq
editReturns whether the context is not equal to the argument.
Accepts: boolean
, number
, string
, null
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
The value compared to the context. |
Returns: boolean
P
editpalette
editCreates a color palette.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed † Alias: |
|
The palette colors. Accepts an HTML color name, HEX, HSL, HSLA, RGB, or RGBA. |
|
|
Make a gradient palette where supported? Default: |
|
|
Reverse the palette? Default: |
Returns: palette
pie
editConfigures a pie chart element.
Accepts: pointseries
Argument | Type | Description |
---|---|---|
|
|
The CSS font properties for the labels. For example, Default: |
|
|
Draws a hole in the pie, between Default: |
|
|
The percentage of the container area to use as a radius for the label circle. Default: |
|
|
Display the pie labels? Default: |
|
|
The legend position. For example, Default: |
|
|
A Default: |
|
|
The radius of the pie as a percentage, between Default: |
|
|
A style of a specific series |
|
|
The percentage of tilt where Default: |
Returns: render
plot
editConfigures a chart element.
Accepts: pointseries
Argument | Type | Description |
---|---|---|
|
|
The default style to use for every series. Default: |
|
|
The CSS font properties for the labels. For example, Default: |
|
|
The legend position. For example, Default: |
|
|
A Default: |
|
|
A style of a specific series |
|
|
The axis configuration. When Default: |
|
|
The axis configuration. When Default: |
Returns: render
ply
editSubdivides a datatable
by the unique values of the specified columns, and passes the resulting tables into an expression, then merges the outputs of each expression.
Accepts: datatable
Argument | Type | Description |
---|---|---|
|
|
The column to subdivide the |
Aliases: |
|
An expression to pass each resulting |
Returns: datatable
pointseries
editTurn a datatable
into a point series model. Currently we differentiate measure from dimensions by looking for a TinyMath
expression. See https://www.elastic.co/guide/en/kibana/current/canvas-tinymath-functions.html. If you enter a TinyMath
expression in your argument, we treat that argument as a measure, otherwise it is a dimension. Dimensions are combined to create unique keys. Measures are then deduplicated by those keys using the specified TinyMath
function
Accepts: datatable
Argument | Type | Description |
---|---|---|
|
|
An expression to use in determining the mark’s color. |
|
|
The size of the marks. Only applicable to supported elements. |
|
|
The text to show on the mark. Only applicable to supported elements. |
|
|
The values along the X-axis. |
|
|
The values along the Y-axis. |
Returns: pointseries
progress
editConfigures a progress element.
Accepts: number
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
Select Default: |
|
|
The color of the background bar. Default: |
|
|
The thickness of the background bar. Default: |
|
|
The CSS font properties for the label. For example, Default: |
|
|
To show or hide the label, use Default: |
|
|
The maximum value of the progress element. Default: |
|
|
The color of the progress bar. Default: |
|
|
The thickness of the progress bar. Default: |
Returns: render
R
editrender
editRenders the context as a specific element and sets element level options, such as background and border styling.
Accepts: render
Argument | Type | Description |
---|---|---|
|
|
The element type to render. You probably want a specialized function instead, such as |
|
|
The style for the container, including background, border, and opacity. Default: |
|
|
Any block of custom CSS to be scoped to the element. Default: |
Returns: render
repeatImage
editConfigures a repeating image element.
Accepts: number
Argument | Type | Description |
---|---|---|
|
|
Fills the difference between the context and Default: |
|
|
The image to repeat. Provide an image asset as a Example value for the |
|
|
The maximum number of times the image can repeat. Default: |
|
|
The maximum height or width of the image, in pixels. When the image is taller than it is wide, this function limits the height. Default: |
Returns: render
replace
editUses a regular expression to replace parts of a string.
Accepts: string
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
The text or pattern of a JavaScript regular expression. For example, |
Alias: |
|
Specify flags. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp. Default: |
|
|
The replacement for the matching parts of string. Capturing groups can be accessed by their index. For example, Default: |
Returns: string
revealImage
editConfigures an image reveal element.
Accepts: number
Argument | Type | Description |
---|---|---|
|
|
An optional background image to reveal over. Provide an image asset as a ``base64`` data URL, or pass in a sub-expression. Default: |
|
|
The image to reveal. Provide an image asset as a Example value for the |
|
|
The position to start the image fill. For example, Default: |
Returns: render
rounddate
editUses a MomentJS formatting string to round milliseconds since epoch, and returns milliseconds since epoch.
Accepts: number
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The MomentJS format to use for bucketing. For example, |
Returns: number
rowCount
editReturns the number of rows. Pairs with ply
to get the count of unique column values, or combinations of unique column values.
Accepts: datatable
Returns: number
S
editsavedLens
editReturns an embeddable for a saved Lens visualization object.
Accepts: any
Argument | Type | Description |
---|---|---|
|
|
The ID of the saved Lens visualization object |
|
|
The timerange of data that should be included |
|
|
The title for the Lens visualization object |
Returns: embeddable
savedMap
editReturns an embeddable for a saved map object.
Accepts: any
Argument | Type | Description |
---|---|---|
|
|
The center and zoom level the map should have |
|
|
The IDs of map layers that should be hidden |
|
|
The ID of the saved map object |
|
|
The timerange of data that should be included |
|
|
The title for the map |
Returns: embeddable
savedVisualization
editReturns an embeddable for a saved visualization object.
Accepts: any
Argument | Type | Description |
---|---|---|
|
|
Defines the color to use for a specific series |
|
|
Specifies the option to hide the legend |
|
|
The ID of the saved visualization object |
|
|
The timerange of data that should be included |
Returns: embeddable
seriesStyle
editCreates an object used for describing the properties of a series on a chart. Use seriesStyle
inside of a charting function, like plot
or pie
.
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
The width of bars. |
|
|
The line color. |
|
|
Should we fill in the points? Default: |
|
|
Sets the orientation of the bars in the chart to horizontal. |
|
|
The name of the series to style. |
|
|
The width of the line. |
|
|
The size of points on line. |
|
|
Specifies if the series should be stacked. The number is the stack ID. Series with the same stack ID are stacked together. |
Returns: seriesStyle
shape
editCreates a shape.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
Pick a shape. Default: |
Alias: |
|
An SVG color for the border outlining the shape. |
Alias: |
|
The thickness of the border. Default: |
|
|
An SVG color to fill the shape. Default: |
|
|
Maintain the shape’s original aspect ratio? Default: |
Returns: shape
sort
editSorts a datatable
by the specified column.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
The column to sort by. When unspecified, the |
|
|
Reverses the sorting order. When unspecified, the Default: |
Returns: datatable
staticColumn
editAdds a column with the same static value in every row. See also alterColumn
and mapColumn
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed * Aliases: |
|
The name of the new column. |
|
|
The value to insert in each row in the new column. TIP: use a sub-expression to rollup other columns into a static value. Default: |
Returns: datatable
string
editConcatenates all of the arguments into a single string.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed † Alias: |
|
The values to join together into one string. Include spaces where needed. |
Returns: string
switch
editPerforms conditional logic with multiple conditions. See also case
, which builds a case
to pass to the switch
function.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed * † Alias: |
|
The conditions to check. |
Alias: |
|
The value returned when no conditions are met. When unspecified and no conditions are met, the original context is returned. |
Returns: Depends on your input and arguments
T
edittable
editConfigures a table element.
Accepts: datatable
Argument | Type | Description |
---|---|---|
|
|
The CSS font properties for the contents of the table. For example, Default: |
|
|
Show pagination controls? When Default: |
|
|
The number of rows to display on each page. Default: |
|
|
Show or hide the header row with titles for each column. Default: |
Returns: render
tail
editRetrieves the last N rows from the end of a datatable
. See also head
.
Accepts: datatable
Argument | Type | Description |
---|---|---|
Unnamed Alias: |
|
The number of rows to retrieve from the end of the Default: |
Returns: datatable
timefilter
editCreates a time filter for querying a source.
Accepts: filter
Argument | Type | Description |
---|---|---|
Aliases: |
|
The column or field that you want to filter. Default: |
|
|
The group name for the filter |
Aliases: |
|
The beginning of the range, in ISO8601 or Elasticsearch |
Aliases: |
|
The end of the range, in ISO8601 or Elasticsearch |
Returns: filter
timefilterControl
editConfigures a time filter control element.
Accepts: null
Argument | Type | Description |
---|---|---|
Aliases: |
|
The column or field that you want to filter. Default: |
|
|
Shows the time filter as a button, which triggers a popover. Default: |
|
|
The group name for the filter. |
Returns: render
timelion
editUses Timelion to extract one or more time series from many sources.
Accepts: filter
Argument | Type | Description |
---|---|---|
Unnamed Aliases: |
|
A Timelion query Default: |
|
|
The Elasticsearch Default: |
|
|
The bucket interval for the time series. Default: |
|
|
The timezone for the time range. See https://momentjs.com/timezone/. Default: |
|
|
The Elasticsearch Default: |
Returns: datatable
timerange
editAn object that represents a span of time.
Accepts: null
Argument | Type | Description |
---|---|---|
|
|
The start of the time range |
|
|
The end of the time range |
Returns: timerange
to
editExplicitly casts the type of the context from one type to the specified type.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed † Alias: |
|
A known data type in the expression language. |
Returns: Depends on your input and arguments
U
editurlparam
editRetrieves a URL parameter to use in an expression. The urlparam
function always returns a string
. For example, you can retrieve the value "20"
from the parameter myVar
from the URL https://localhost:5601/app/canvas?myVar=20
.
Accepts: null
Argument | Type | Description |
---|---|---|
Unnamed * Aliases: |
|
The URL hash parameter to retrieve. |
|
|
The string returned when the URL parameter is unspecified. Default: |
Returns: string
V
editvar
editUpdates the Kibana global context.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
Specify the name of the variable. |
Returns: Depends on your input and arguments
var_set
editUpdates the Kibana global context.
Accepts: any
Argument | Type | Description |
---|---|---|
Unnamed * Alias: |
|
Specify the name of the variable. |
Alias: |
|
Specify the value for the variable. When unspecified, the input context is used. |
Returns: Depends on your input and arguments