Expected fields not available in kibana visualation

[KZ_Win]

I can perform a search on index pattern with range queries on certain fields and I wanted to do visualization on the same set of fields. However these fields are not available in any kind of visualization. Any idea of what I am doing wrong ? I am using kibana/elasticsearch 5.6

I can post any necessary information here.

Thanks in advance

[cjcenizal]

Hi there, could you share some screenshots indicating what you're seeing in Discover and Visualize?

Here are some similar threads which might also be helpful:

• Kibana Visualize - Field not showing
• Some index string fields not appearing in visualization aggregation

The solution in both cases involved changing the mapping.

Thanks,
CJ

[KZ_Win]

Here are the relevant screenshots.

I looked into both threads and I don't think my problem is similar to theirs.

[cjcenizal]

Thanks! See the question mark next to the field in Discover? That means the field mapping is of an unknown type. It needs to be of number type in order for it to be available for a range aggregation. You can try refreshing your index pattern in Management > Index Patterns by clicking the refresh icon at the top right corner of that screen. If that doesn't resolve your problem you can try deleting the index and reindexing to create new mappings.

Please let me know if this helps.

CJ

[KZ_Win]

That's very useful to know

1. That EL could not tell that this is not a number type is odd because in logstash filter there is an explicit mutation like this

         convert => {
                      "response_code" => "integer"
                      "latency" => "float"
                      "upstream_latency" => "float"
                      "bytes" => "integer"
                     }
      }

2. I could do proper range queries on these numbers.

3. Without doing any extra mapping configuration, I split off these types of logs into own index, in the management console these fields show up with correct types.