Cannot properly display object in Kibana Discover

[NadyLeez123 (Nadine Metago)]

Hello!

We just migrate from kibana 7.6.2 to 7.15.1
We have a field named ConteneurUnity( object type), with nested fields as showed in the mapping below:

"ConteneurUnity": {
                "type": "object",
                "properties": {
                  "Type": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "ignore_above": 256,
                        "type": "keyword"
                      }
                    }
                  },
                  "Mapped": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "ignore_above": 256,
                        "type": "keyword"
                      }
                    }
                  },
                  "Interface": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "ignore_above": 256,
                        "type": "keyword"
                      }
                    }
                  },
                  "LifeTimeManager": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "ignore_above": 256,
                        "type": "keyword"
                      }
                    }
                  }
                }
              }

In 7.6 version, data in ConteneurUnity were properly displayed as a table of objects :

"ConteneurUnity" : [

            {
              "Type" : "[default]",
              "Interface" : "IUnityContainer",
              "LifeTimeManager" : "Container"
            },
            {
              "Type" : "[default]",
              "Mapped" : "ConsulterReleveCompte",
              "Interface" : "IConsulterReleveCompte",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "Parametres",
              "Interface" : "IParametres",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "TraducteurObtentionMandat",
              "Interface" : "ITraducteurObtentionMandat",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "TraducteurReleveCompteDetail",
              "Interface" : "ITraducteurReleveCompteDetail",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "ConfigurationInfrastructure",
              "Interface" : "IConfigurationInfrastructure",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "GestionStatistique",
              "Interface" : "IGestionStatistique",
              "LifeTimeManager" : "Transient"
            },
            {
              "Type" : "[default]",
              "Mapped" : "StockageSession",
              "Interface" : "IStockage",
              "LifeTimeManager" : "Singleton"
            },
            {
              "Type" : "[default]",
              "Mapped" : "GestionDemande",
              "Interface" : "IGestionDemande",
              "LifeTimeManager" : "Singleton"
            },
            {
              "Type" : "[default]",
              "Mapped" : "PersistanceContexteTT11",
              "Interface" : "IPersistanceContexte",
              "LifeTimeManager" : "Singleton"
            },
            {
              "Type" : "[default]",
              "Mapped" : "PersistancePortailTT11",
              "Interface" : "IPersistance",
              "LifeTimeManager" : "Singleton"
            },
            {
              "Type" : "[default]",
              "Mapped" : "GestionContexteUtilisateur",
              "Interface" : "IGestionContexteUtilisateur",
              "LifeTimeManager" : "Transient"
            }
          ]
        },
        "_ingest" : {
          "_value" : null,
          "timestamp" : "2022-05-13T14:14:02.865829981Z"
        }
      }
    }

Then, look at how it is displayed now in 7.15:

ConteneurUnity.Interface : IUnityContainer, IEnvironnementExecution, ISecuriteRoles, ILocalisateurAdresse, IProxyFactory, ILocalisateurMediateur, IGestionCheminAcces, IJournalisationEnveloppe, IEnvExecutionElement, IParametresColElements, ICheminsAccesColElements, ICommunicationColElements, IRessourceElement, IParamApplicatif

ConteneurUnity.LifeTimeManager: Container, Singleton, Singleton, Singleton, Singleton, Singleton, Transient, Singleton, Singleton, Singleton, Singleton, Singleton, Singleton, Transient

ConteneurUnity.Mapped: EnvironnementExecution, SecuriteRolesAD, LocalisateurAdresseStructurateurURL, ProxyFactory, LocalisateurMediateur, GestionCheminAcces, JournalisationEnveloppe, AccesseursUnityConfig, AccesseursUnityConfig, AccesseursUnityConfig, AccesseursUnityConfig

ConteneurUnity.Type: [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default], [default]

So, Kibana seems to be displaying the contain of each nested field, instead of simply displaying the ConteneurUnity object.

Any idea? I'm wondering what changed in this new version.

Thanks.

[Tomo_M (Tomohiro Mitani)]

In 7.6 Kibana used _source field by default. After 7.12, Kibana/Discover uses fields API by default. In 7.6, Kibana only reflected the json expression you indexed. After 7.12, it reflects the way how the data indexed.

Elasticsearch has special "nested" field type for nested objects. With "object" field type, their internal objects are disassembled and indexed as a simple flat list of key-value paris, just as displayed in 7.15. If you need to index arrays of objects, see nested field type.

In my opinion, 7.15 behaviour more reflects the internal data structure of Elasticsearch and lead to less misunderstanding.

[NadyLeez123 (Nadine Metago)]

@Tomo_M

Thanks

Your answer is pretty clear. Everything is fine now.