How to split the JSON field in kibana?

Elastic Stack Kibana
1

I recently upgraded to version 7.12, and I found that kibana recombined all fields into JSON arrays, but this would cause me trouble. I need to copy the original JSON format. I checked the configuration on the kibana page and found no way to cancel the relevant settings.

Is there any way to go back to kibana 7.4?

{
	"_index": "mall_log-2021.04",
	"_type": "_doc",
	"_id": "CgO57ngB9aH-qYyQaaZD",
	"_version": 1,
	"_score": null,
	"fields": {
		"SourceType": [
			"MallAssistLog"
		],
		"Token": [
			""
		],
		"LogLevel": [
			"info"
		],
		"ApiName.keyword": [
			"getItemVend"
		],
		"@version": [
			"1"
		],
		"@timestamp": [
			"2021-04-20T10:00:31.708Z"
		]
	},
	"sort": [
		1618912831708
	]
}

The data format I see on logstash is this way（This is what I need ）

{
	"Token": "",
	"@version": "1",
	"SourceType": "MallAssistLog",
	"LogLevel": "info",
	"ApiName": "getItemVend",
	"@timestamp": "2021-04-20T10:10:38.143Z",
	"Data": {
		"responsedto": {
			"error": null,
			"success": true,
			"result": [{
				"itemId": "2100010032",
				"VendAccount": "",
				"name": "",
				"qty": 3325.0
			}],
			"targetUrl": null,
			"unAuthorizedRequest": false,
			"__abp": true
		},
		"requestdto": [{
			"itemId": "2100010032"
		}]
	}
}
2

I found the answer from the kibana documentation.

Just open “discover:searchFieldsFromSource to true” to solve.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.