I can't see all index fields in kibana lens

[orsa (Pavel Kozlov)]

Hi
I created an index for the network hardware syslog.
Data in the index is written correctly. The data is also searchable in the discovery panel.
When I start lens, I get an incomplete list of fields.
Only tags and timestamp are available in the panel.

kibana lens does not see values in these fields, they are empty for it. but if you look at discovery, these fields have values.

where the error can be located?

[flash1293 (Joe Reuter)]

Hi @orsa, there are multiple possible causes for this:

• Lens only shows the fields which exist in the time range selected in the top right. Try expanding the time range.
• If you are using Kibana 7.5 there is a known bug with missing fields in index patterns created in Kibana version 7.3: https://github.com/elastic/kibana/issues/52114
• Lens is only showing aggregatable fields. Are your fields indexed as keyword or text? If they are of type text, Lens won't be able to work with them. If that's the case you will have the same problem when trying to visualize them in other visualization types like regular line chart

[orsa (Pavel Kozlov)]

hi @flash1293

thank you for answer.

@flash1293

Lens only shows the fields which exist in the time range selected in the top right. Try expanding the time range

i test it solution
if I take the same period
i view field value in discovery, and lens not show it

@flash1293

If you are using Kibana 7.5 there is a known bug with missing fields in index patterns created in Kibana version 7.3: [Lens] Keyword fields not listed by Lens for any index patterns following upgrade · Issue #52114 · elastic/kibana · GitHub

i`m use Kibana 7.7.0 and 7.7.1

@flash1293

Lens is only showing aggregatable fields. Are your fields indexed as keyword or text? If they are of type text, Lens won't be able to work with them. If that's the case you will have the same problem when trying to visualize them in other visualization types like regular line chart

i my mapping long and keyword data type and in kibana index map it`s field mark as aggregatable.

[orsa (Pavel Kozlov)]

by an exception method, it turns out that the problem is either in my incorrect index template or in kibana mapping for my index. since the index fields created by beats or kibana sample data are perfectly visible in lens

i`am add my template to gist

[flash1293 (Joe Reuter)]

Did you change the template at some point? You can try going to Management > Index patterns and refresh your index pattern. This should picking up recent changes.

[orsa (Pavel Kozlov)]

no, template and mapping not change.

refresh index pattern not result (

[flash1293 (Joe Reuter)]

Did you try to create a regular visualization? Does that work?

[orsa (Pavel Kozlov)]

yes, now i create simple "vertical bar" for count field "event.action"

[flash1293 (Joe Reuter)]

Are you ingesting documents with dots in the field names?

If yes it's likely you are running into this bug: https://github.com/elastic/kibana/issues/63630

A fix should be released with the next upcoming version 7.8