We updated our ELK from 7.* to 8.4.2, and we used from our backups to restoring visualization, dashboards, data views (index pattern) and ...
We had problems that were fixed, except for the following :
I have a document in Elasticsearch that has all metadata fields (_index, _id, _score, _source) but I can't use _id in my visualizations (But I could before)
These are some screen snip of my problem description:
Details
Previously, it was possible to aggregate and sort on the built-in _id field by loading an expensive data structure called fielddata. This was deprecated in 7.6 and is now disallowed by default in 8.0.
Impact
Aggregating and sorting on _id should be avoided. As an alternative, the _id field’s contents can be duplicated into another field with docvalues enabled (note that this does not apply to auto-generated IDs).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.