7.16.1 - All beats docs in Discover had unknown field and value as json

[Zabulon]

Hi,

Yeserday, I upgraded one of our cluster from 7.13.4 to 7.16.1. When I'm going to discover pane and choose a beat index, almost all field show as 'unknown field' and the values are showing as JSON.

The other cluster is still in 7.13.4 and the beat docs in discover pane looks like it supposed to:

If you have any insight it would be appreciate !!

Thank you

Dominic

[matw (Matthias Wilhelm)]

Hi
I'd be interested how the response of the agent field looks like when it's displayed in INSPECT

And about the fields, looking at the sidebar, what's displayed for agent? What's displayed when you deactivate "Hide empty fields"

thx and best,
Matthias

[Zabulon]

Hi Matthias,

There is the INSPECT portion of two different filebeat version:

And there is the sidebar parts:

Thank you !

Dominic

[Zabulon]

Hi Matthias,

I think I resolved my issue.

I turned off the setting "discover:searchFieldsFromSource" and it work fine.

result:

Thank you very much for your help !

Dominic

[matw (Matthias Wilhelm)]

thank you. I'd be interested, if you'd switch discover:searchFieldsFromSource to Off if this would work in this case?

[Zabulon]

Hi Matthias,

Like I said in the my last post , Yes it resolved the issue..

Thank you very much !

Dominic

[matw (Matthias Wilhelm)]

Cool, didn't see your post, so we seem to have posted synchronously

All the best!
Matthias