How to add fileds to index pattren , so it can be filterd by in discover search

Elastic Stack Kibana
1

i defined simple index pattern " filebeat-*"
and it has only a few fields which i can filter by:

image
image162×649 15.3 KB

now i like to add new fields to this index pattern. which i can see they exist

image
image764×751 40.7 KB

but i can't find anywhere how to add them so i could get the data that i could filter by
what I'm missing here?

for example i like to add :
kubernetes.pod.name
and
kubernetes.container.name

so i cloud do search like :
kubernetes.pod.name : "my-pod-nameX"

i followed this tutorial:


and i do see all the logs in kibana
2

The field list in discover is sampled from the first 500 documents - if the field doesn't have a value in these documents, it won't show up. You can show the complete list based on the mapping by clicking "Filter by type" and unchecking "Hide missing fields".

Alternatively you can add a new filter below the search bar and just use the field (it will show up in the suggestions of the field input) - this will make sure the 500 documents contain that field and it will also show up in the sidebar.

3

Thanks for answering
Do you have idea why i can't get the value of the kubernetes.pod.name?
As i can see the info in the logs ?

4

I don't understand your question, can you explain what you seeing and what you expect to see?

5

hey
thanks for answering i would happily explain more if i could make it work, as my installation have a lot of problems
see here :

6

As Kibana is the top of the stack, it probably makes sense to resolve all problems in the lower levels first before coming back to troubleshoot Kibana. In a lot of cases the problems aren't even caused by Kibana in the first place but the data itself is not in order in Elasticsearch.

7

thanks for answering, sure you are right, the problem is that it just stopped working after and uninstall it once and installed it again but this time with a custom namespace, then everything stopped to work.
this question from my first install with the "default" namespace. as we not allowed to use the "default" namespace.
and even then it didn't get me all the info . like
kubernetes.pod.name
kubernetes.container.name

i saw allot of questions regarding the DNS with out any answer .. so I'm afraid my case will be the same

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.