Hi,
when I want to see the top 5 values for a field in discover, some documents are ignored and thus not showing in "top 5 values". for example if a select the facility field I can't see "SEC_LOGIN" value:
The "top 5" values are sampled from the first 500 documents shown in the table. If these documents do not contain the value you are after, this is expected behavior and it's not possible to change it.
To get the actual top values of your data set, use a visualization with the "terms" aggregation
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.