Can't see all the value of my field in kibana

Elastic Stack Kibana
1

Hello, I'm currently working with Kibana. I try to filter my data according to a certain field but I notice that it does not display all the values of this field. just the first 10 values. How can I fix this?

2

It also happens when I add a conrol to filter my dashboard. All the values of my field are not displayed

3

Hi @Hanni,

if you open Dicover and inspect the fields data are all values shown?
Is your problem within a visualization (i.e. Lens chart/datatable) or with a saved search?

4

normally I have all my values in my discover for this field. But when I add a control on my dashboard, it doesn't show me all of them.

5

Can you share the mapping of the field?

6 
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "CVE": {
        "type": "keyword"
      },
      "CVSS_v2": {
        "properties": {
          "0_Base_Score": {
            "type": "keyword"
          }
        }
      },
      "Host": {
        "type": "keyword"
      },
      "Nom_Application": {
        "type": "keyword"
      },
      "Plugin_ID": {
        "type": "integer"
      },
      "Port": {
        "type": "keyword"
      },
      "Protocol": {
        "type": "keyword"
      },
      "Risk": {
        "type": "keyword"
      },
      "date": {
        "type": "date"
      },
      "event": {
        "properties": {
          "original": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      },
      "host": {
        "properties": {
          "name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      },
      "log": {
        "properties": {
          "file": {
            "properties": {
              "path": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          }
        }
      },
      "message": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}
7

Controls are fed by keyword values, which are a subset of values from their text field parent.
I say subset as any text field longer than 256 chars is ignored as a keyword (the aggregatable side of text fields).

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.