Field showing in Discover tab but not getting aggregated in Visualizations

(Sushant Sood) #1

Hi I have a field loglevel which has values DEBUG,INFO,ERROR etc and all these 3 values for loglevel are showing up in Discover tab when i search using query loglevel: DEBUG | INFO | ERROR , but when i am creating visualization using term loglevel , only DEBUG and INFO are showing up for the same search interval . Please suggest where i am missing .

(Sushant Sood) #2

This is the mapping i have defined for loglevel :

"loglevel" : {
"type" : "string",
"norms" : {
"enabled" : false
"fielddata" : {
"format" : "disabled"
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256

(Sushant Sood) #3

Hi team any updates?

(Tyler Smalley) #4

It sounds like the there is only data containing DEBUG and INFO for the selected timespan. Try expanding the timespan and verifying there is data containing loglevel:ERROR

(Sushant Sood) #5

I checked the same logs for same timespan and there were ERROR logs showed up in discover tab.

(system) #6