Is there a way to add the _id meta field to a table visualization?
In most integrations, each document has metadata associated with it, such as the _id metadata fields. Try deleting "_id" in the search bar and searching again. IT could also be problem with the data view. Try refreshing or replicating the view in a new view and see if there are any changes. You can also check each individual winlogbeat* index and check individually that the _id metafield shows up.
hope this helps
The _id field is restricted from use in aggregations, sorting and scripting, that's why you cannot use it in a visualization.
If you want you need to duplicate this field into another one, how you do that depends on how are you indexing your data.
Are you using elastic agent integrations? If so, you would need to create a custom ingest pipeline and use a set processor to copy the _id field to another field, like searchable_id or any name you want.
It is not possible to do that, the _id field cannot be deleted.
1 Like
Thanks for correcting me, I meant "delete _id " from the search bar text box. Now that I look again, I agree with you, the _id is restricted from aggregations