ES 1.5.1, Kibana 3.
I recently updated the mapping template for an index/type to use doc_value:
{
"order": 0,
"template": "containerlogs-*",
"settings": {},
"mappings": {
"ContainerLog": {
"properties": {
"path": {
"index": "not_analyzed",
"type": "string",
"doc_values": true <<< new line
},
"host": {
"index": "not_analyzed",
"type": "string",
"doc_values": true <<< new line
}
}
}
},
"aliases": {}
}
We use daily indexes. In our Kibana dashboard we have a terms panel for the field environment
(note that it's not even in the template). After the change that panel is now inexplicably returning all results as Missing field
in that panel for all indexes since the change. However, I can still query and filter based on the field, and all the results in a table show as having a value for environment
I grabbed the query that the panel was running and did a curl directly and ES is indeed returning everything as Missing field
. Running the query on an older index does return the correct result (just as Kibana showed). I then went ultra basic and did a query like /_search?q=environment:prd
on both an older and newer index and they both returned results. So it's something about the terms query.
Both an older and newer index have the same mapping for environment: "environment" : { "type" : "string" }
.
I'm not seeing anything related to this in the ES client node's log. Any ideas?