Exisisting field doesn't show on Dashboard filters, but it does in discover and visualizations

Hi a specific field doesn't show on the filter of the dashboards, but it exists and can be found in discovery

image

and in the visualizations
image

I have reloaded the index pattern, checked his existance through a month, but still not showing in the filters of the dashboard

image

any clue on what is going on?

Version 7.8

Hi it's hard to know what may be going on (I tried a few simple tests on a clean 7.8 cluster) so I'm asking a few question that may help to find the root cause

  • Can you share the underlying index mapping?
  • Can you share an screenshot of the index pattern definition?
  • Does the field show up in other fKibana apps filter UI's like Discover or Lens?

And probably the most important is if you could share a defined set of steps you can share to reproduce?

1 Like

Mapping
image

Index pattern

Yes, the field show up in the Discover and lens, also in TSVB

restarted kibana but still the same, in the past the field was shown normally

I dont know what can i tell you to reproduce the error, just try to search or filter in the dasboard, and the autocomplete doesnt show the field, and when I try to force it (writing the field anyway) doesnt give me any result.

Deleted the index pattern, and recreate it...still the same

Hi @Incauto,

Have an idea where the bug coming from, but I realize that is very unlikely the case for you:

  • Is metrics-interface-* the default index pattern in Kibana?
  • Do you have other similar index patterns which have q_incident_source, but not q_incident_source.keyword
  • Do you have visualizations other then TSVB on that dashboard that use metrics-interface-*.
  • Do you have other visualizations on that dashboard that use other index patterns? Maybe the one that doesn't have q_incident_source.keyword

The fact that filter editor doesn't show all the fields when TSVB is in play could be related to https://github.com/elastic/kibana/issues/81476 bug

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.