Show description in legend instead of numbers

[freephoneid]

Hi,

My log snippet is as shown below:

productid=12 email=abc@gg.com
productid=13 email=pqr@aa.com
productid=14 email=xyz@cc.com

I've a timechart with below query:

index=myindex sourcetype=mylog | timechart count by productid

Now this chart shows line properly but the legend are shown with product id & its difficult to interpret those product ids via numbers.

Since there are 3 products here, it shows 3 lines with these product ids. Is there any way to show the legend as Product Name instead of product id in the right side of panel?

So, if I want to show "Product1" for 12 & "Product2" for 13 & "Product3" for 14 in the legends, how can I do that?

Any help is much appreciated!

Thanks!

[imrago · Accepted solution]

index=myindex sourcetype=mylog | eval productname=case(productid==12,"Product1",productid==13,"Product2",productid==14,"Product3")| timechart count by productname

[MarioM]

the best way would be a csv fields lookup

ex:
productid,productname

12,product12

13,product13

...

then your chart would be:

index=myindex sourcetype=mylog | timechart count by productname