I have the following index mappings that I set up from PHP.
"index" => "my-index-name",
"body" => [
"settings" => [
"number_of_replicas" => 0,
"number_of_shards" => 1,
],
"mappings" => [
"_source" => [
"enabled" => true,
],
"properties" => [
"@timestamp" => [
"type" => "date",
],
"status" => [
"type" => "keyword",
],
"os" => [
"type" => "keyword",
],
"ip" => [
"type" => "ip",
],
"action" => [
"type" => "keyword",
],
"userEmail" => [
"type" => "text",
],
"userId" => [
"type" => "integer",
],
"acceptedAt" => [
"type" => "date",
"format" => "yyyy-MM-dd HH:mm:ss",
],
"processedAt" => [
"type" => "date",
"format" => "yyyy-MM-dd HH:mm:ss",
],
"acceptedData" => [
"type" => "nested",
],
"returnedData" => [
"type" => "nested",
],
"appVersion" => [
"type" => "version",
],
],
],
],
At first the "nested" type fields were available in Discover to search and I was able to create Lens visualizations using these fields.
I had to restart the ELK docker stack and now none if these fields are searchable and Lens no longer see them.
In Discover section they seem like they are empty
but as you can see, these nested objects/fields are indeed not empty
I tried to recreate whole Index and Index pattern, but that did not help. I have no idea what is going on. Any tips?