# Kibana discovery display

**URL:** <https://discuss.elastic.co/t/kibana-discovery-display/220967>\
**Category:** Kibana\
**Created:** [February 26, 2020, 7:58am UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967 "2020-02-26T07:58:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [February 26, 2020, 7:58am UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/1 "2020-02-26T07:58:14Z")

</div>

Hello,  
i have a question about display in Kibana discovery, json section.  
Can someone tell me why date fields are displayed twice in json? In example i have a field event\_date (timezone is UTC +1).  
`event.event_date	2020-02 -26 @ 08:54:54.570`  
And there is a section "fields" that display same field but in UTC

> ```
> "fields": {
> "@timestamp": [
> "2020-02-26T07:54:54.570Z"
> ],
> "event.event_date": [
> "2020-02-26T07:54:54.570Z"
> ]
> },
> 
> ```

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [February 26, 2020, 3:45pm UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/2 "2020-02-26T15:45:33Z")

</div>

Hello @tennaen

It looks like you have two different fields with the same value. How are documents being added to elasticsearch?

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [February 27, 2020, 6:30am UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/3 "2020-02-27T06:30:23Z")

</div>

Hello @mattkime, thank you for quick response. I'm using Logstash to read from Postgres. This is my pipeline configuration:

```
 input {
        jdbc {
                jdbc_driver_class => "Java::org.postgresql.Driver"
                jdbc_connection_string => "jdbc:postgresql://db_ip:5432/db_name"
                jdbc_user => "db_user"
                jdbc_password => "${db_user_pass}"
                statement => "select * from T_AUDIT_LOG_EVENT where id > :sql_last_value"
                use_column_value => true
                tracking_column => id
                tracking_column_type => "numeric"
                #clean_run => true
                schedule => "* * * * *"
                last_run_metadata_path => "/u01/data/ls_logs/uat/.logstash_jdbc_last_run"
        }
 }
 filter {
        json {
                source => "value"
                target => "event"
        }
        mutate {
                add_field => {
                        "[@metadata][event_type]" => "%{[event][event_type]}"
                }
        }
        mutate {
                lowercase => ["[@metadata][event_type]"]
        }
        date {
                timezone => "Europe/Warsaw"
                match => ["[event][event_date]", "YYYY-MM-dd HH:mm:ss.SSS", "ISO8601"]
                target => "@timestamp"
        }
 }
 output {
        elasticsearch {
                hosts => "elastic_ip:9200"
                user => elasticuser
                password => "${elasticuserpass}"
                index => "uat-focus-audit-log--%{[@metadata][event_type]}"
                #document_type => "audit-log-events"
                document_id => "%{id}"
        }
        #stdout {
        # codec => "rubydebug"
        #}
 }
```

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [February 28, 2020, 8:57am UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/4 "2020-02-28T08:57:41Z")

</div>

I've checked pipeline output, and there are no additional fields.

---

<div class="post-metadata">

**Author:** ![tennaen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tennaen/32/87293_2.png) [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Post date:** [March 10, 2020, 1:34pm UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/5 "2020-03-10T13:34:20Z")

</div>

Anyone has idea what can be reason for double fields in output?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2020, 1:34pm UTC](https://discuss.elastic.co/t/kibana-discovery-display/220967/6 "2020-04-07T13:34:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.