Field content shown in json but not in table

Elastic Stack Kibana
1

Hello,

I have a weird problem : my facility field is shown as empty in kibana.
But when I display the JSON, it seem OK.


Am I doing something wrong or is this a bug ?
Elasticsearch version 2.2.1 and kibana version 4.4.1.

2

It looks like kibana thinks the field is a number. Did your mappings change at some point? Can you try refreshing your index pattern from the settings page?

3

Hello,

I never modified the index pattern, il left it to the default logstash-*.
Same thing for the mappings,

Here they are :

root@sv-t-vnl-logs-bddr01:~# curl -XGET localhost:9200/_template/logstash?pretty
{
"logstash" : {
"order" : 0,
"template" : "logstash-",
"settings" : {
"index" : {
"number_of_shards" : "6",
"routing" : {
"allocation" : {
"include" : {
"type" : ""
},
"require" : {
"type" : "StockageChaud"
}
}
},
"refresh_interval" : "5s"
}
},
"mappings" : {
"default" : {
"dynamic_templates" : [ {
"message_field" : {
"mapping" : {
"fielddata" : {
"format" : "disabled"
},
"index" : "analyzed",
"omit_norms" : true,
"type" : "string"
},
"match_mapping_type" : "string",
"match" : "message"
}
}, {
"string_fields" : {
"mapping" : {
"fielddata" : {
"format" : "disabled"
},
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"ignore_above" : 256,
"index" : "not_analyzed",
"type" : "string",
"doc_values" : true
}
}
},
"match_mapping_type" : "string",
"match" : ""
}
}, {
"float_fields" : {
"mapping" : {
"type" : "float",
"doc_values" : true
},
"match_mapping_type" : "float",
"match" : ""
}
}, {
"double_fields" : {
"mapping" : {
"type" : "double",
"doc_values" : true
},
"match_mapping_type" : "double",
"match" : ""
}
}, {
"byte_fields" : {
"mapping" : {
"type" : "byte",
"doc_values" : true
},
"match_mapping_type" : "byte",
"match" : ""
}
}, {
"short_fields" : {
"mapping" : {
"type" : "short",
"doc_values" : true
},
"match_mapping_type" : "short",
"match" : ""
}
}, {
"integer_fields" : {
"mapping" : {
"type" : "integer",
"doc_values" : true
},
"match_mapping_type" : "integer",
"match" : ""
}
}, {
"long_fields" : {
"mapping" : {
"type" : "long",
"doc_values" : true
},
"match_mapping_type" : "long",
"match" : ""
}
}, {
"date_fields" : {
"mapping" : {
"type" : "date",
"doc_values" : true
},
"match_mapping_type" : "date",
"match" : ""
}
}, {
"geo_point_fields" : {
"mapping" : {
"type" : "geo_point",
"doc_values" : true
},
"match_mapping_type" : "geo_point",
"match" : ""
}
} ],
"_all" : {
"omit_norms" : true,
"enabled" : true
},
"properties" : {
"@timestamp" : {
"type" : "date",
"doc_values" : true
},
"geoip" : {
"dynamic" : true,
"type" : "object",
"properties" : {
"ip" : {
"type" : "ip",
"doc_values" : true
},
"latitude" : {
"type" : "float",
"doc_values" : true
},
"location" : {
"type" : "geo_point",
"doc_values" : true
},
"longitude" : {
"type" : "float",
"doc_values" : true
}
}
},
"@version" : {
"index" : "not_analyzed",
"type" : "string",
"doc_values" : true
}
}
}
},
"aliases" : { }
}
}

4

Hmm then maybe your data has changed. Why don't you explicitly set the type for the facilities field?

5

I tried to specify %{WORD:facility:string} in logstash but the problem is still here :frowning:

6

If you reindex with a new mapping you'll have to refresh on the Kibana side too. On the settings page for your index there's an orange refresh button you'll have to press after changing the mapping.

7

It worked !

Many thanks for your help.