Mapping an object field in order to show in the Kibana discover

Elastic Stack Kibana
1

HI, I have a field called "unqiue_db_tag" in my document.

somehow it does not show on the table but only on JSON

I looked at other discussion says it could be due to this field is not yet dont the mapping since I add this field by enrich processor.

If I would like to map this field so that It will show up on the discover left search bar and on the table.

Is my below mapping correct?

this is the field:
Capture

PUT index/_mapping
{

"properties": {
  "unqiue_db_tag": {
    "type": "object",
    "properties": {
      "codeNumCount": {
        "type": "long"
      },
      "brandIdCount": {
        "type": "long"
      },
      "region": {
        "type": "keyword"
      },
      "deviceId": {
        "type": "long"
      },
      "db_tag": {
        "type": "keyword"
      }
    }
  }
}

}

only
only1907×931 183 KB

unique_db_field
unique_db_field1915×811 125 KB

could anyone help?

2

I'm not entirely sure about that comment that if you added a field to your json doc via enrich processor that the field won't show up in the mapping. Either way if you don't see the object in your mapping, does it exist in _source? if so, you can create a runtime field in Kibana from source.

Here is an example of runtime field on source

get myindex/_search
{
  "runtime_mappings": {
    "codeNumCount": {
      "type": "long",
      "script": """
          emit(params._source.unqiue_db_tag.codeNumCount);
          """
    }
  },
  "query": {
    "match_all": {}
  },
  "fields": ["codeNumCount"],
  "_source": false
}
3

Hi @JasonREC,

What is your current value for discover:searchFieldsFromSource on Advanced Settings page? And does JSON view include unqiue_db_tag.... values in fields section?

Also it could be that unqiue_db_tag.* were set to be excluded based on settings on Stack Management > Data view > Field filters page.