I have what I think is an easy question, but for some reason I can't get a straight answer. I am using Kibana with another tool. The tool has documents in it that have 10 fields. 3 of those fields are date fields. If I export the data as dates into my index then only the documents that have the dates populated will show up. In other words if I have 100 items I want to see and 10 of them don't have dates populated (but they do have the 7 other fields) then they won't show. However, if I publish the index as strings (rather than dates) then I have the option to display missing fields - meaning I can see the 10 document that don't have the date fields. That said, not having the dates as actual dates is creating some formatting issues when I export it, so I'm curious if there is a way to have a date field as a date field, but to also show documents that are missing that field. As it is now when I have them set as date fields the "show missing" is greyed out.
...I should add, when I say I can't see them I mean if I setup a data table visualization. In discover I see things whether or not the date fields are missing or not.
When you define the index pattern/dataview for your index, did you define and a default time field for that?
If the problem is that your fields are put in the Empty fields when in the Lens Editor, mind that it does not mean your fields are actually empty, rather that the editor sampling process didn't encounter any data with them.
@Marco_Liberati I probably didn't do a good job of explaining things. We have a bit of a limited deployment. I'm using a 3rd party tool that includes integration to Kibana to display dashboards. In the third party tool I have index mappings. I may mess up the nomenclature, so I'll try and explain it as simple as I can. In my tool I may have 100 objects. Those objects have 10 fields for capturing meta data (vendor, type of object, owner, etc).
When I map this to Kibana and go into discover I see the index, and the objects (I think they are called documents) and the meta data that is attached shows up as different fields. So I will see something like this:
Name: Object 1
Vendor: Microsoft
Owner: John Doe
Purchase Date: 1/1/2022
End of Life: 1/1/2024
End of Service:
Name: Object 2
Vendor: Adobe
Owner: Jane Doe
Purchase Date: 1/1/2022
End of Life: 1/1/2024
End of Service: 1/1/2025
...and I see all of that in discover. However - if I mappings the purchase and end of life and end of service as "dates" then when I create a visualization data table and put all 3 of those date fields in - only object two will be displayed b/c when creating that visualization I don't have the option to display missing fields if the fields are "dates". If they are strings then I can display missing fields which allows me to have a data table that shows both object 1 and object 2.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.