Feedback on top_metrics UI in transforms (added in 7.14).

• select a better parent name

From the UI, we try to use a dest field naming convention that groups fields together. E.g. CPU.min and CPU.max are both children of CPU . The UI workflow takes the initial selected field to use as the parent name.

Now top_metrics is available, this creates weird filenames as the initial field selected might not logically be a sensible parent name.

Current implementation will causes top metrics fields, depending on whatever was selected first, such as phone_no.top_metrics.last_name and DiskReadBytes.top_metrics.CPUUtilization .

To workaround, it can be renamed, but this is not ideal because it seems like it will always need to be renamed.

Suggest (short term):

• top_metrics becomes the parent. e.g. top_metrics.last_name and top_metrics.phone_no

• If multiple separate top_metrics have been selected, then increment the additional ones (top_metrics1 and top_metrics2)

• removing advanced settings

Advanced settings exist for configuring sorting of array fields. This only become visible after selecting the sort field and sort order. Both of these are required, therefore the adv settings are always displayed at the end.
It is unlikely that sorting on arrays is required and therefore it should be removed from the UI in order to simplify. As with other niche settings, it should still be possible to configure using the JSON editor.

• select default soft fields

The user should be able to configure a preferred sort field and direction. However in many cases, there will only be 1 element and sorting will not make a difference.

Suggest keeping the ability for user to pick their own sort fields, but picking a sensible default so they do not always have to click and select. If a time field has been included in the group by or aggregation, pick this and sort by most recent. If there are multiple time fields, then choose the first one included in the group by. Otherwise leave it for the user to select their own sort field, with a default of desc.

• for info: configuring top_metrics.size

Transforms will only return the first element even if a user configures size to be a value greater than 1 using the JSON editor. There is no protection code that stops the user from setting it to another value. More discussion here elastic/elasticsearch#74420. Including for reference and for visibility. However no actions required.