Kibana not splitting fields by dot anymore

Elastic Stack Kibana
1

Hello,

I'm wondering why Kibana has stopped splitting fields. For example, we used to have separate fields for "cloud.provider", "cloud.machine.type", but now it's just a single "cloud" field.

NPC95bc4BXv16UnwXwOiJufl
NPC95bc4BXv16UnwXwOiJufl1358×560 89.1 KB

It's interesting that the fields can still be filtered by, individually, in the search bar:

nQltFV8VAbrWCq3QSqV1nyBv
nQltFV8VAbrWCq3QSqV1nyBv1176×272 25.5 KB

How can we fix this? How can we debug this?

2

What is the mapping of your cloud field? Which version of Kibana are you? In the advanced settings, under Discover, what is the value of fieldsFromSource setting?

3

Hi, thanks for the quick answer.

Cloud field mapping: (By the way, it's not unique to the cloud field, it happens on all fields.)

          "cloud": { - 
            "properties": { - 
              "account": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "availability_zone": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "instance": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  },
                  "name": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "machine": { - 
                "properties": { - 
                  "type": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "project": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "provider": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "region": { - 
                "type": "keyword",
                "ignore_above": 1024
              }
            }
          },

Kibana version: 6.4.1

As far as I can tell, the advanced settings area doesn't have a fieldFromSource setting.

4

6.4 has already reached EOL. It's really hard to say what's jappening there. I would suggest upgrading to one of the more recent versions.

5

Thanks @majagrubic , we've now upgraded from 6.4 to 6.8.23, and the issue persists. (I assume 6.8 is supported?)

In the sidebar, it says "Analysis is not available for object fields"

Could it be an issue with the index mapping?

EDIT: I removed and re-added the index pattern from the Kibana Management page. That fixed the problem!

(I had to manually change the index pattern UUID back to the old one in the .kibana6 ES index for my saved searches to work, though)

1 Like
6

Are the mappings completely common among all the indices in the index pattern?

It is only a possibility but judging from the side-bar message, if the mappings of some indices contain {"cloud": {"type": "object"}}, it could occur.

7

6.8.x is still supported but only until 8.0.0 release.

1 Like
8

I think we updated the mapping some days before this started happening. To that might have been what triggered it. :thinking:

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.