Fields don't appear as expected

Elastic Stack Kibana
1

I have a stack installed in Kubernetes that is as follows:

  • Elasticsearch 6.6.1
  • Fluent-Bit 1.0.4
  • Kibana 6.6.1

Kubernetes metadata (as a JSON object containing fields like "pod_name" and "host") is passed in to Kibana, but Kibana does not show them as fields in the Discover page. Under "selected fields" there is "kubernetes" with a question mark beside it. If I uncheck "Hide missing fields", I see the fields I expect, such as "kubernetes.pod_name", though Kibana insists they are not present in the data. I can filter on them and run visualizations without an issue, but cannot get statistics in the "selected field" column since Kibana doesn't believe they are present.

I assume Kibana is just failing to recognize them in the data despite identifying them well enough to put them in the field list. I went as far as blowing away all my data and reinstalling everything from scratch, and see the same issue. I am fairly new to Kibana so it's possible I've just set something up wrong. Any help would be very appreciated.

2

It kind of depends on your mapping inside Elasticsearch, but in general the field counts that show up in Discover are only for the 500 first results that Discover pulls up, and not for all of the data inside Elasticsearch.

What is your mapping for kubernetes and its subfields?

3

I have no specific mapping for it, which may be my problem! I will work on getting that in place.

Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.