Kibana not splitting fields by dot anymore

[fredsted (Simon Fredsted)]

Hello,

I'm wondering why Kibana has stopped splitting fields. For example, we used to have separate fields for "cloud.provider", "cloud.machine.type", but now it's just a single "cloud" field.

It's interesting that the fields can still be filtered by, individually, in the search bar:

How can we fix this? How can we debug this?

[majagrubic (Maja)]

What is the mapping of your cloud field? Which version of Kibana are you? In the advanced settings, under Discover, what is the value of fieldsFromSource setting?

[fredsted (Simon Fredsted)]

Hi, thanks for the quick answer.

Cloud field mapping: (By the way, it's not unique to the cloud field, it happens on all fields.)

          "cloud": { - 
            "properties": { - 
              "account": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "availability_zone": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "instance": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  },
                  "name": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "machine": { - 
                "properties": { - 
                  "type": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "project": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "provider": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "region": { - 
                "type": "keyword",
                "ignore_above": 1024
              }
            }
          },

Kibana version: 6.4.1

As far as I can tell, the advanced settings area doesn't have a fieldFromSource setting.

[majagrubic (Maja)]

6.4 has already reached EOL. It's really hard to say what's jappening there. I would suggest upgrading to one of the more recent versions.

[fredsted (Simon Fredsted)]

Thanks @majagrubic , we've now upgraded from 6.4 to 6.8.23, and the issue persists. (I assume 6.8 is supported?)

In the sidebar, it says "Analysis is not available for object fields"

Could it be an issue with the index mapping?

EDIT: I removed and re-added the index pattern from the Kibana Management page. That fixed the problem!

(I had to manually change the index pattern UUID back to the old one in the .kibana6 ES index for my saved searches to work, though)

[Tomo_M (Tomohiro Mitani)]

Are the mappings completely common among all the indices in the index pattern?

It is only a possibility but judging from the side-bar message, if the mappings of some indices contain {"cloud": {"type": "object"}}, it could occur.

[Tomo_M (Tomohiro Mitani)]

6.8.x is still supported but only until 8.0.0 release.

ElasticプロダクトのEOL/サポート終了日 | Elastic

[fredsted (Simon Fredsted)]

I think we updated the mapping some days before this started happening. To that might have been what triggered it.