# Kibana report not reading \_source

**URL:** https://discuss.elastic.co/t/kibana-report-not-reading-source/281625
**Category:** Kibana
**Created:** [August 17, 2021, 4:20am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625 "2021-08-17T04:20:15Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 17, 2021, 4:20am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/1 "2021-08-17T04:20:15Z")

</div>

Hi Team,

Kibana version 7.13.4.  
I've enabled read fields from \_source in Kibana advanced settings.

Issue -  
I've saved a search in Kibana and tried to generate the CSV, however only the Timestamp has a value.  
\_source simply shows "-" values.

 ![error with _source](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b5f9fc9426a7447ae3896698f8b4c8e82f7de54.jpeg)

I also tried adding a few fields and only date fields were showing values.

 ![error with fields](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04e17aae1c67ec84c6515e4190f0d3007c211f82.jpeg)

We have recently updated from 7.8 and the same process worked there without issues.

---

<div class="post-metadata">

### Author: ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)
#### Post date: [August 20, 2021, 2:11pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/2 "2021-08-20T14:11:27Z")

</div>

What visualization / query tool are you using for your query and subsequent CSV export?

---

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 23, 2021, 3:45am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/3 "2021-08-23T03:45:40Z")

</div>

@monfera,

This is using Discover.

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [August 23, 2021, 1:24pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/4 "2021-08-23T13:24:33Z")

</div>

Hi,

`_source` is not meant to work when exporting CSV from Discover. Can just paste the mapping for the two remaining fields?

---

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 24, 2021, 3:52am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/5 "2021-08-24T03:52:55Z")

</div>

@majagrubic,

In Kibana 7.8 even if I didn't have any fields added in my Discover search it would automatically create a CSV of the entire document.

And the question in the second screenshot is why does the \_created\_at column have values while the other two do not?

When I checked Inspect on the saved search I get the JSON of the Document correctly.  
It's just not converting to a CSV.

Mappings -

APIName -

```auto
"APIName": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              },
              "norms": false
            },

```

errorCode -

```auto
"errorCode": {
                      "type": "text",
                      "fields": {
                        "keyword": {
                          "type": "keyword",
                          "ignore_above": 256
                        }
                      },
                      "norms": false
                    },

```

errorMessage -

```auto
"errorMessage": {
                      "type": "text",
                      "fields": {
                        "keyword": {
                          "type": "keyword",
                          "ignore_above": 256
                        }
                      },
                      "norms": false
                    },

```

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [August 24, 2021, 12:27pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/6 "2021-08-24T12:27:17Z")

</div>

Sorry, I wasn't clear. Starting from 7.13 not showing `_source` in a CSV export is expected.

Do you have `fieldsFromSource` enabled in the Advanced settings? `keyword` fields won't have a value with `fieldsFromSource` enabled. If you have a saved search that is referencing those fields, it is expected that they would show up with empty values. Can you please recheck those two things?

---

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 24, 2021, 12:36pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/7 "2021-08-24T12:36:21Z")

</div>

@majagrubic,

You're spot on `fieldsFromSource` enabled in Advanced Settings as the team wanted to view the documents in json.  
And you're right again, the fields I added in the Saved Search were keyword fields.

Looks like if I want CSV exports I have to disable `fieldsFromSource`.

Is there any workaround to show the document response in raw json?

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [August 24, 2021, 1:37pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/8 "2021-08-24T13:37:57Z")

</div>

We have a JSON view for each document, but I don't think you will ever be able to see the raw json in a CSV file. If you disable `fieldsFromSource`, you should be able to view all fields (with values 🙂 ) in a CSV file.

---

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 25, 2021, 3:52am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/9 "2021-08-25T03:52:35Z")

</div>

Sorry, I think even I wasn't clear enough.  
Viewing the JSON and the CSV are two different requirements.

In Discover if we open a document we get two options -  
i. Table view  
ii. Json view

 ![Discover view document](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ce2db3fed782cd8579fa1a3a7a16e4e45d17e0d4.jpeg)

Now the problem is if we disable `fieldsFromSource` the JSON reads with each field in a separate line.  
However if we do enable it then we are able to read json in the "Expanded document" view in the correct data structure.

So as you were saying in the previous post if we disable `fieldsFromSource` we'll be able to export CSVs however if we enable it we lose the raw Json view in Discover's "Expanded document" view.

If there is a workaround to view raw json in Discover with `fieldsFromSource` disabled that would be the ideal solution, otherwise I'll have to ask my team to prioritise one or the other.

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [August 25, 2021, 1:11pm UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/10 "2021-08-25T13:11:07Z")

</div>

There is no workaround for this in 7.13. However, we implemented [this](https://github.com/elastic/kibana/pull/101392) in 7.14. Upgrading to 7.14 should give you what you need.

---

<div class="post-metadata">

### Author: ![fidsamurai](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)
#### Post date: [August 26, 2021, 3:40am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/11 "2021-08-26T03:40:56Z")

</div>

That's great!! Thanks a ton!!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2021, 3:41am UTC](https://discuss.elastic.co/t/kibana-report-not-reading-source/281625/12 "2021-09-23T03:41:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
