Add visualize with some missing field

I have different system logs with missing field that depending of user action.
{@timestamp, user:A, src:, action:login, dst:}
{@timestamp, user:A, action:logout, dst:}

When I try to create a visualize table with kibana, if I split my data in:
@timestamp,user,src,action,dst only first log login appears because the second log don't have any "src" field.

How can I show all logs without change data structure.

I use an old kibana 4.

I am not sure how to do this in Kibana 4, but in newer version of kibana, you can enable "show missing values". This will create a bucket for documents that are missing src so they are displayed in the table

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.