Kibana doesn't show all field form the document

Hi Guy,
I have the problem that Kibana me the field what is call "stackTrace".

The first JSON is from the index out of elasticsearch:
{ "_index" : "filebeat-7.12.0-2021.04.27-000020", "_type" : "_doc", "_id" : "djxdE3kBzAdnYPSvUA-M", "_version" : 1, "_seq_no" : 26535563, "_primary_term" : 1, "found" : true, "_source" : { "container" : { "image" : { "name" : "nexus.services.nublar.de/soffico/ohe-basic:4.8.1.2-74" }, "runtime" : "docker", "id" : "ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a" }, "date" : "27.04.2021/14:45:50.376", "kubernetes" : { "container" : { "image" : "nexus.services.nublar.de/soffico/ohe-basic:4.8.1.2-74", "name" : "orchestra-patient" }, "node" : { "uid" : "d92bb9c1-fc0e-11ea-ab62-005056b303e9", "hostname" : "qdl0400-ocp2052.digen.nublar.de", "name" : "qdl0400-ocp2052.digen.nublar.de", "labels" : { "node-role_kubernetes_io/compute" : "true", "kubernetes_io/hostname" : "qdl0400-ocp2052.digen.nublar.de", "beta_kubernetes_io/os" : "linux", "beta_kubernetes_io/arch" : "amd64" } }, "pod" : { "uid" : "e80ae4de-a5e6-11eb-8f01-005056b37d51", "name" : "orchestra-patient-183-5ng74" }, "namespace" : "icw-ehealth-suite-qs", "namespace_uid" : "9f453264-fc11-11ea-ab62-005056b303e9", "labels" : { "template" : "orchestra-patient-48", "app" : "orchestra-patient-48", "deploymentconfig" : "orchestra-patient", "readyness" : "ohe", "name" : "orchestra-patient", "deployment" : "orchestra-patient-183" } }, "log" : { "file" : { "path" : "/var/lib/containers/docker/containers/ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a/ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a-json.log" }, "offset" : 524401813 }, "ecs" : { "version" : "1.8.0" }, "stream" : "stderr", "host" : { "name" : "qdl0400-ocp2052.digen.nublar.de" }, "stackTrace" : """emds.epi.decl.exceptions.TechnicalException: Failed to connect to jms queue: Could not create Transport. Reason: java.io.IOException: Could not load resource: D:\data\Orchestra\Designer\app_4812\orchestra\WEB-INF\classes\config\security\orchestra.keystore at emds.driver.jms.BaseJMSConnectionFactory.createNonXAConnection(BaseJMSConnectionFactory.java:124) at emds.epi.impl.landscapedirectory.jms.JMSBaseConnectionFactory.getQueueSession(JMSBaseConnectionFactory.java:231) at emds.epi.impl.adapter.jms.JMSPointToPointConnectionFactory.createConnections(JMSPointToPointConnectionFactory.java:51) at emds.epi.impl.adapter.jms.JMSPointToPointConnectionFactory.establishConnection(JMSPointToPointConnectionFactory.java:63) at emds.epi.impl.adapter.jms.JMSReceiver.establishConnection(JMSReceiver.java:151) at emds.epi.impl.adapter.jms.JMSReceiver.checkJmsMessagesNoXA(JMSReceiver.java:350) at emds.epi.impl.adapter.jms.JMSReceiver.checkForJmsMessages(JMSReceiver.java:220) at emds.epi.impl.adapter.jms.JMSReceiver$JMSReceiverThread.run(JMSReceiver.java:94) Caused by: javax.jms.JMSException: Could not create Transport. Reason: java.io.IOException: Could not load resource: D:\data\Orchestra\Designer\app_4812\orchestra\WEB-INF\classes\config\security\orchestra.keystore at org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:36) at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:122) at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:346) at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:304) at org.apache.activemq.ActiveMQConnectionFactory.createQueueConnection(ActiveMQConnectionFactory.java:261) at emds.driver.jms.BaseJMSConnectionFactory.createNonXAConnection(BaseJMSConnectionFactory.java:121) ... 7 more Caused by: java.io.IOException: Could not load resource: D:\data\Orchestra\Designer\app_4812\orchestra\WEB-INF\classes\config\security\orchestra.keystore at org.apache.activemq.ActiveMQSslConnectionFactory.getInputStream(ActiveMQSslConnectionFactory.java:206) at org.apache.activemq.ActiveMQSslConnectionFactory.loadClientCredential(ActiveMQSslConnectionFactory.java:167) at org.apache.activemq.ActiveMQSslConnectionFactory.createKeyManager(ActiveMQSslConnectionFactory.java:150) at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:114) ... 11 more """, "sourceMethode" : "handleJMSException", "pipelinestep" : [ "step2", "step1" ], "sourceMessage" : "[sc_stammdaten_sync] [ch_db_update_stamm_oscare] JMS-Receiver: Failed to look for ingoing messages", "DocumentState" : "correct", "level" : "SEVERE", "message" : """had to delete because too many character""", "input" : { "type" : "container" }, "environment" : { "name" : "QS" }, "@timestamp" : "2021-04-27T12:45:50.388Z", "ThreadID" : 507, "sourceClass" : "emds.epi.impl.adapter.jms.JMSReceiver" } }

and second JSON is that what kibana shows me:

{ "_index": "filebeat-7.12.0-2021.04.27-000020", "_type": "_doc", "_id": "djxdE3kBzAdnYPSvUA-M", "_score": 1, "fields": { "kubernetes.node.uid": [ "d92bb9c1-fc0e-11ea-ab62-005056b303e9" ], "kubernetes.namespace_uid": [ "9f453264-fc11-11ea-ab62-005056b303e9" ], "container.id": [ "ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a" ], "kubernetes.node.labels.beta_kubernetes_io/os": [ "linux" ], "kubernetes.node.hostname": [ "qdl0400-ocp2052.digen.nublar.de" ], "agent.type": [ "filebeat" ], "kubernetes.node.labels.node-role_kubernetes_io/compute": [ "true" ], "kubernetes.container.name": [ "orchestra-patient" ], "kubernetes.node.labels.beta_kubernetes_io/arch": [ "amd64" ], "log.file.path": [ "/var/lib/containers/docker/containers/ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a/ca4b8805fc31246359cfec33ff5a703c0c889455dfd48f2ede8d1e903e0e627a-json.log" ], "kubernetes.labels.deploymentconfig": [ "orchestra-patient" ], "log.offset": [ 524401813 ], "environment.name": [ "QS" ], "agent.version": [ "7.12.0" ], "kubernetes.pod.name": [ "orchestra-patient-183-5ng74" ], "kubernetes.labels.deployment": [ "orchestra-patient-183" ], "message": [ "{\"date\":\"27.04.2021\\/14:45:50.376\",\"sourceMessage\":\"[sc_stammdaten_sync] [ch_db_update_stamm_oscare] JMS-Receiver: Failed to look for ingoing messages\",\"level\":\"SEVERE\",\"ThreadID\":507,\"sourceClass\":\"emds.epi.impl.adapter.jms.JMSReceiver\",\"stackTrace\":\"emds.epi.decl.exceptions.TechnicalException: Failed to connect to jms queue: Could not create Transport. Reason: java.io.IOException: Could not load resource: D:\\\\data\\\\Orchestra\\\\Designer\\\\app_4812\\\\orchestra\\\\WEB-INF\\\\classes\\\\config\\\\security\\\\orchestra.keystore\\n\\tat emds.driver.jms.BaseJMSConnectionFactory.createNonXAConnection(BaseJMSConnectionFactory.java:124)\\n\\tat emds.epi.impl.landscapedirectory.jms.JMSBaseConnectionFactory.getQueueSession(JMSBaseConnectionFactory.java:231)\\n\\tat emds.epi.impl.adapter.jms.JMSPointToPointConnectionFactory.createConnections(JMSPointToPointConnectionFactory.java:51)\\n\\tat emds.epi.impl.adapter.jms.JMSPointToPointConnectionFactory.establishConnection(JMSPointToPointConnectionFactory.java:63)\\n\\tat emds.epi.impl.adapter.jms.JMSReceiver.establishConnection(JMSReceiver.java:151)\\n\\tat emds.epi.impl.adapter.jms.JMSReceiver.checkJmsMessagesNoXA(JMSReceiver.java:350)\\n\\tat emds.epi.impl.adapter.jms.JMSReceiver.checkForJmsMessages(JMSReceiver.java:220)\\n\\tat emds.epi.impl.adapter.jms.JMSReceiver$JMSReceiverThread.run(JMSReceiver.java:94)\\nCaused by: javax.jms.JMSException: Could not create Transport. Reason: java.io.IOException: Could not load resource: D:\\\\data\\\\Orchestra\\\\Designer\\\\app_4812\\\\orchestra\\\\WEB-INF\\\\classes\\\\config\\\\security\\\\orchestra.keystore\\n\\tat org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:36)\\n\\tat org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:122)\\n\\tat org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:346)\\n\\tat org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:304)\\n\\tat org.apache.activemq.ActiveMQConnectionFactory.createQueueConnection(ActiveMQConnectionFactory.java:261)\\n\\tat emds.driver.jms.BaseJMSConnectionFactory.createNonXAConnection(BaseJMSConnectionFactory.java:121)\\n\\t... 7 more\\nCaused by: java.io.IOException: Could not load resource: D:\\\\data\\\\Orchestra\\\\Designer\\\\app_4812\\\\orchestra\\\\WEB-INF\\\\classes\\\\config\\\\security\\\\orchestra.keystore\\n\\tat org.apache.activemq.ActiveMQSslConnectionFactory.getInputStream(ActiveMQSslConnectionFactory.java:206)\\n\\tat org.apache.activemq.ActiveMQSslConnectionFactory.loadClientCredential(ActiveMQSslConnectionFactory.java:167)\\n\\tat org.apache.activemq.ActiveMQSslConnectionFactory.createKeyManager(ActiveMQSslConnectionFactory.java:150)\\n\\tat org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:114)\\n\\t... 11 more\\n\",\"sourceMethode\":\"handleJMSException\"}" ], "kubernetes.node.labels.kubernetes_io/hostname": [ "qdl0400-ocp2052.digen.nublar.de" ], "kubernetes.labels.readyness": [ "ohe" ], "container.image.name": [ "nexus.services.nublar.de/soffico/ohe-basic:4.8.1.2-74" ], "kubernetes.labels.app": [ "orchestra-patient-48" ], "input.type": [ "container" ], "stream": [ "stderr" ], "kubernetes.container.image": [ "nexus.services.nublar.de/soffico/ohe-basic:4.8.1.2-74" ], "@timestamp": [ "2021-04-27T12:45:50.388Z" ], "ThreadID": [ 507 ], "agent.ephemeral_id": [ "45a39d3c-5d1a-4638-81bb-379afd84a326" ], "sourceClass": [ "emds.epi.impl.adapter.jms.JMSReceiver" ], "date": [ "27.04.2021/14:45:50.376" ], "kubernetes.namespace": [ "icw-ehealth-suite-qs" ], "host.name": [ "qdl0400-ocp2052.digen.nublar.de" ], "sourceMethode": [ "handleJMSException" ], "level": [ "SEVERE" ], "kubernetes.labels.template": [ "orchestra-patient-48" ], "container.runtime": [ "docker" ], "ecs.version": [ "1.8.0" ], "kubernetes.node.name": [ "qdl0400-ocp2052.digen.nublar.de" ], "kubernetes.pod.uid": [ "e80ae4de-a5e6-11eb-8f01-005056b37d51" ], "kubernetes.labels.name": [ "orchestra-patient" ], "sourceMessage": [ "[sc_stammdaten_sync] [ch_db_update_stamm_oscare] JMS-Receiver: Failed to look for ingoing messages" ] } }

can anyone give me a tip what I doing wrong?

Hi

We switched to the use of the fields API in Discover recently, but we will also return _source. You currently have to set discover:searchFieldsFromSource to on for having ES return _source again. Here is an issue you could track for also having _source while having the benefits of fields

More context about this switch:

Best,
Matthias

thanks for the quick reply.
its working now

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.