Field missing when select Top Hit on Y-axis for bar chart

Hi all,

I'm trying to use Top Hit on my bar chart but many fields are missing from the field selection.

Below are my custom field which came from filebeat (ansible.xxxxxx)

Here when I selected Top Hit, all my ansible field missing.

image

How is ansible and child properties defined in the mappings?

ansible.xxxx fields came from the field "message" and I used filebeat processor dissect to separate "message" into each ansible field

For example below

processors:
  - dissect:
      tokenizer: "%{ansible.xxx},%{ansible.xxx}"
      field: "message"
      target_prefix: ""

Not sure this answer on what you asked.

No, I meant the mapping definition of your index in Elasticsearch: Get mapping API | Elasticsearch Guide [8.4] | Elastic

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.