Hi all,
I'm trying to use Top Hit on my bar chart but many fields are missing from the field selection.
Below are my custom field which came from filebeat (ansible.xxxxxx)
Here when I selected Top Hit, all my ansible field missing.
Hi all,
I'm trying to use Top Hit on my bar chart but many fields are missing from the field selection.
Below are my custom field which came from filebeat (ansible.xxxxxx)
Here when I selected Top Hit, all my ansible field missing.
How is ansible
and child properties defined in the mappings?
ansible.xxxx fields came from the field "message" and I used filebeat processor dissect to separate "message" into each ansible field
For example below
processors:
- dissect:
tokenizer: "%{ansible.xxx},%{ansible.xxx}"
field: "message"
target_prefix: ""
Not sure this answer on what you asked.
No, I meant the mapping definition of your index in Elasticsearch: Get mapping API | Elasticsearch Guide [8.4] | Elastic
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.