# Kibana not splitting fields by dot anymore

**URL:** <https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826>\
**Category:** Kibana\
**Created:** [January 31, 2022, 11:02am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826 "2022-01-31T11:02:34Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredsted](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fredsted/32/6656_2.png) [@fredsted](https://discuss.elastic.co/u/fredsted)\
**Post date:** [January 31, 2022, 11:02am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/1 "2022-01-31T11:02:35Z")

</div>

Hello,

I'm wondering why Kibana has stopped splitting fields. For example, we used to have separate fields for "cloud.provider", "cloud.machine.type", but now it's just a single "cloud" field.

 ![NPC95bc4BXv16UnwXwOiJufl](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68968a7d0ac0b604954033b5892fb76025082a0a.png)

It's interesting that the fields can still be filtered by, individually, in the search bar:

 ![nQltFV8VAbrWCq3QSqV1nyBv](https://us1.discourse-cdn.com/elastic/original/3X/0/2/029730587432d03107503721f265612a566f851a.png)

How can we fix this? How can we debug this?

---

<div class="post-metadata">

**Author:** ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)\
**Post date:** [January 31, 2022, 1:50pm UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/2 "2022-01-31T13:50:11Z")

</div>

What is the mapping of your cloud field? Which version of Kibana are you? In the advanced settings, under `Discover`, what is the value of `fieldsFromSource` setting?

---

<div class="post-metadata">

**Author:** ![fredsted](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fredsted/32/6656_2.png) [@fredsted](https://discuss.elastic.co/u/fredsted)\
**Post date:** [January 31, 2022, 2:41pm UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/3 "2022-01-31T14:41:01Z")

</div>

Hi, thanks for the quick answer.

Cloud field mapping: (By the way, it's not unique to the cloud field, it happens on all fields.)

```auto
          "cloud": { - 
            "properties": { - 
              "account": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "availability_zone": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "instance": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  },
                  "name": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "machine": { - 
                "properties": { - 
                  "type": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "project": { - 
                "properties": { - 
                  "id": { - 
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              },
              "provider": { - 
                "type": "keyword",
                "ignore_above": 1024
              },
              "region": { - 
                "type": "keyword",
                "ignore_above": 1024
              }
            }
          },

```

Kibana version: 6.4.1

As far as I can tell, the advanced settings area doesn't have a `fieldFromSource` setting.

---

<div class="post-metadata">

**Author:** ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)\
**Post date:** [January 31, 2022, 3:45pm UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/4 "2022-01-31T15:45:08Z")

</div>

6.4 has already reached EOL. It's really hard to say what's jappening there. I would suggest upgrading to one of the more recent versions.

---

<div class="post-metadata">

**Author:** ![fredsted](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fredsted/32/6656_2.png) [@fredsted](https://discuss.elastic.co/u/fredsted)\
**Post date:** [February 9, 2022, 9:37am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/5 "2022-02-09T09:37:51Z")

</div>

Thanks @majagrubic , we've now upgraded from 6.4 to 6.8.23, and the issue persists. (I assume 6.8 is supported?)

In the sidebar, it says "Analysis is not available for object fields"

Could it be an issue with the index mapping?

**EDIT:** I removed and re-added the index pattern from the Kibana Management page. That fixed the problem!

(I had to manually change the index pattern UUID back to the old one in the .kibana6 ES index for my saved searches to work, though)

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 9, 2022, 9:58am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/6 "2022-02-09T09:58:29Z")

</div>

Are the mappings completely common among all the indices in the index pattern?

It is only a possibility but judging from the side-bar message, if the mappings of some indices contain `{"cloud": {"type": "object"}}`, it could occur.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 9, 2022, 10:00am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/7 "2022-02-09T10:00:24Z")

</div>

6.8.x is still supported but only until 8.0.0 release.

> **[ElasticプロダクトのEOL/サポート終了日 | Elastic](https://www.elastic.co/jp/support/eol)**

---

<div class="post-metadata">

**Author:** ![fredsted](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fredsted/32/6656_2.png) [@fredsted](https://discuss.elastic.co/u/fredsted)\
**Post date:** [February 9, 2022, 10:01am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/8 "2022-02-09T10:01:01Z")

</div>

I think we updated the mapping some days before this started happening. To that might have been what triggered it. 🤔

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2022, 10:01am UTC](https://discuss.elastic.co/t/kibana-not-splitting-fields-by-dot-anymore/295826/9 "2022-03-09T10:01:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
