7.16.1 - All beats docs in Discover had unknown field and value as json


Yeserday, I upgraded one of our cluster from 7.13.4 to 7.16.1. When I'm going to discover pane and choose a beat index, almost all field show as 'unknown field' and the values are showing as JSON.

The other cluster is still in 7.13.4 and the beat docs in discover pane looks like it supposed to:

If you have any insight it would be appreciate !!

Thank you


I'd be interested how the response of the agent field looks like when it's displayed in INSPECT

And about the fields, looking at the sidebar, what's displayed for agent? What's displayed when you deactivate "Hide empty fields"

thx and best,

Hi Matthias,

There is the INSPECT portion of two different filebeat version:

And there is the sidebar parts:

Thank you !


Hi Matthias,

I think I resolved my issue.

I turned off the setting "discover:searchFieldsFromSource" and it work fine.


Thank you very much for your help !


1 Like

thank you. I'd be interested, if you'd switch discover:searchFieldsFromSource to Off if this would work in this case?

Hi Matthias,

Like I said in the my last post , Yes it resolved the issue..

Thank you very much !


Cool, didn't see your post, so we seem to have posted synchronously :slight_smile:

All the best!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.