Kibana Visualize - Field not showing

Elastic Stack Kibana
1

Hi everyone,

I'm still new at this so please forgive me. I am attempting to visualize some data in Kibana by using:
Data Table > Split Row > Aggregation > Terms.

The problem here is I am unable to locate "event_data.CommandLine" from the "Field" drop down

Terms.png1530×1376 174 KB

I can confirm that "event_data.CommandLine" does exist as I am able to show logs picking this field up:

commandline.png2048×142 22.3 KB

I've also gone into the Management > Index Patterns.....showing this field exists.

managment.png2504×1176 255 KB

Can anyone help me out in getting this field displayed in the Visualize menu?

Thanks everyone!

2

Hi Jim,

I encountered the same issue, not sure if the approach is right, but I mapped the fields to keywords, or use the raw multifield mapping,

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "city": {
          "type": "text",
          "fields": {
            "raw_city": { 
              "type":  "keyword"
            }
          }
        }
      }
    }
  }
}

reference link:
https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html

and it worked for me.

Hope this helps you too

Best,
J

3

Thanks J, will give it a go!