Enrich textual cells with visual hashes

[antbell]

Describe the feature:

Visual hashes, such as identicon, associate images to values in a deterministic way. This allows to check for equality in the data by comparing the corresponding images.

In the "Discover" view, add the option to enrich columns with visual hashes. This will allow to notice at a glance:

• values occurring frequently;
• breaks in long runs of the same value;
• outliers.

Describe a specific use case for the feature:

Visual hashes for the following mocks have been created with the TFlag visual hash from the visual-hash python library.

e-commerce example

The switch from Saturday to Friday is very easy to spot. It's also apparent that no continent is predominant and that in the visible data there is a long run of female buyers.

logs example

The response status is almost always 200 and the exceptions are very easy to spot.

Notes

There is a small probability that different values are hashed to the same images, so equality of images does not imply equality of the values, but different images always correspond to different values.

Different types of visual hashes could be used for different columns. For attributes with small cardinality, such as gender or day of the week in the above examples, even a single color would be enough. For country codes, the country flag could be used. For IPs, sub-hashes for the first and last octets could be used.

[elasticmachine]

Pinging @elastic/kibana-app

[timroes]

cc @kertal Something like that (I totally like the idea btw) would be a really good use-case for why we should be able to set field formatters per column in discover. We could easily write a field formatter for that, and then you can use it in discover on the columns you need, without the requirement of having that somehow popping up in charts or other visualizations.

[jughosta]

Quick update: Discover supports "Color" field formatters now.

[antbell]

A possible extension of this idea: provide the possibility to only display the visual hash for a column and only show the text value on hover. This would allow a very compact and effective representation of fields with low cardinality but large textual representation.

[dej611]

A possible workaround for this would be, given a identicon image API, to create a runtime field and using a URL formatter of the type Image and a configuration like the following:

Here's an example for the url.keyword field, where a runtime field url_visual_hash has been defined:

[kertal]

@dej611 this sounds like a field formatter extension, if we intend to implement it... you workaround is pretty cool!

[kertal]

We are closing this in order to provide better transparency of priorities. This issue won't be prioritized in the near future.
We track it in #163011 for longer term planning.