Hi,
when I want to see the top 5 values for a field in discover, some documents are ignored and thus not showing in "top 5 values". for example if a select the facility field I can't see "SEC_LOGIN" value:
but if I manually add the filter and in the same time range as before, the "SEC_LOGIN" value is visible now:
I tried latest chrome and firefox browser but nothing changed.
The "top 5" values are sampled from the first 500 documents shown in the table. If these documents do not contain the value you are after, this is expected behavior and it's not possible to change it.
To get the actual top values of your data set, use a visualization with the "terms" aggregation
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
