Transforming columns into object with key-value pairs

Hi,
Is there a transformation that would be an inverse of Extract fields? I need to compress multiple columns into one column with one object. There’s Add field from Calculation with “All Values” mode, but it just makes an array, I need to be able to make {key: "<column name>", value: "<column value>"} object?

this is sometimes possible on the query level, you can concat fields with strings depending on the datasource. You can do binary adds but it only supports 2 fields and doesn’t separate by anything, I thought maybe something with maths, but I can’t seem to get the labels out. In the end, working it out in the query should be your best bet. what is your data source?

Elasticserach with logs mode, so I don’t think there’s any field for manipulation

do you need this for the display name or to calculate some aggregate?

I tried to hack my way around Traces panel and managed to do so with reducing rows (Add field from calculation), as it creates new field (unlike renaming transformations), but I wanted to pass tags as well, so that resource and span attributes would be visible.

got the necessary data frame from here https://play.grafana.org/d/edodkfmj0tce8f/traces-panel?orgId=1&from=now-6h&to=now&timezone=browser&editPanel=1 (changed trace to table) but I guess there’s no easy way to do the tags :sweat_smile:

which data source are you using? infinity or ES datasource to access your data

ES datasource. If I used Infinity, there wouldn’t be that question :joy:

i use infinity exclusively for ES

can you add a GROK pattern to your ELK?

then leverage UQL or JQ to do what I want

I’m not quite sure, I don’t know much about Elastic itself but I’d rather not configure anything on ingestion. There are many users of Elastic in my company (the same index) and I’d rather not manipulate the data itself in the backend. It’s just an experiment and a hacky one to begin with, so I was just curious how hacky can I get :sweat_smile:

If they would want more of this PoC I guess there won’t be a better way right now, thanks for the pointers :grin:

nie jestem pewien czy rozumiem ale ok