Halo,
I am using elastic cloud ELK. I have created an index with a mapping containing several nested fields. I checked on Kibana and it looks fine. However when I try to write a query in KQL for the nested field, it does not behave the way it should. According to this merge request, and the screenshot below, the autocomplete suggestion should start suggesting a nested syntax while I start to type in the nested field, but it didn't.
My index mapping shown in Kibana is as this:
> "field_1": {
> "type": "nested",
> "properties": {
> "sub-field_1": {
> "type": "text",
> "fields": {
> "keyword": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
> "sub-field_2": {
> "type": "text",
> "fields": {
> "keyword": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
Also I have tried querying the sub-field directly with a wildcard search, like field_1.sub-field_1: *
, but not a single result returned.
Does anyone know what went wrong? Thanks!