Vega-Lite基于lastEvent值调整填充色的ELK日志可视化问题排查

数据老陈

2026-9-25

解决方案

核心修改点

给Elasticsearch查询新增排序和条数限制，仅返回最新1条设备日志，避免多日志干扰判定
配置Vega数据解析规则，正确读取ES返回的嵌套结构里的字段值，解决lastEvent读取为undefined的问题

修正后完整代码

{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "data": {
    "url": {
      "%context%": false,
      "%timefield%": "@timestamp",
      "index": "mtconnect*",
      "body": {
        "size": 1,
        "sort": [
          {
            "@timestamp": {
              "order": "desc"
            }
          }
        ]
      }
    },
    "format": {"property": "hits.hits"}
  },
  "transform": [
    {"calculate": "datum._source.lastEvent", "as": "lastEvent"}
  ],
  "height": "container",
  "width": "container",
  "mark": "rect",
  "encoding": {
    "color": {
      "condition": [
          {"test": "datum['lastEvent'] === 'ACTIVE'", "value": "blue"},
          {"test": "datum['lastEvent'] === 'STOPPED'", "value": "red"},
          {"test": "datum['lastEvent'] === 'READY'", "value": "green"},
          {"test": "datum['lastEvent'] === 'UNAVAILABLE'", "value": "black"},
          {"test": "datum['lastEvent'] === 'PROGRAM_STOPPED'", "value": "pink"},
          {"test": "datum['lastEvent'] === 'FEED_HOLD'", "value": "purple"},
          {"test": "datum['lastEvent'] === 'INTERRUPTED'", "value": "yellow"}
          ],
      "value": "Pink"
    }
  }
}