Field showing in Discover tab but not getting aggregated in Visualizations

Elastic Stack Kibana
1

Hi I have a field loglevel which has values DEBUG,INFO,ERROR etc and all these 3 values for loglevel are showing up in Discover tab when i search using query loglevel: DEBUG | INFO | ERROR , but when i am creating visualization using term loglevel , only DEBUG and INFO are showing up for the same search interval . Please suggest where i am missing .

2

This is the mapping i have defined for loglevel :

"loglevel" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fielddata" : {
"format" : "disabled"
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}

3

Hi team any updates?

4

It sounds like the there is only data containing DEBUG and INFO for the selected timespan. Try expanding the timespan and verifying there is data containing loglevel:ERROR

5

I checked the same logs for same timespan and there were ERROR logs showed up in discover tab.