I was exploring kibana5.2 , my index contains date field which is in EPOC so I converted it and I can see all the 52 fields in kibana .The problem is out of 52 only 10 fields are searchable , also kibana only shows value in discover tab if I configure Index pattern with @timestamp . If I configure index with any other date field I got an error in Kibana shown below .
FYI , I have converted this field as below date {match => ["rt","UNIX_MS"] target => "rt" }
As shown rt is a date field but it neither searchable nor aggregated whereas, sev is searchable as well as aggregated .
Even I was thinking this could be a mapping issue but I guess this is not the case as I can see field type is getting changed as per mapping . Here is my Index mapping
I do not understand this opened case , why I can see document with @timestamp but not with any other date field.
Yes, I do have data/document in my index. I can see no of documents in an index = no of file lines.
My guess is that you didn't have data in the index when you added it to Kibana, but now you do. The other date fields aren't defined correctly, because the data wasn't there when the mappings were being read. If you refresh your mappings, I'm guessing things will start working.
So you were right after refresh this were working fine . So the problem was with the mapping initially and on top of that LS was saying that data has been parsed but it was not actually sending data in the index.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.