Hello Elasticsearch community,
I'm currently facing an issue where "popular fields" in Kibana are not persistent or consistent across users.
When I reload the Discover view or log in as a different user, the popularity counts disappear, and the ordering of fields resets.
What I’ve observed
-
Each user seems to have their own “popular fields” state.
-
The popularity count increases when I select fields in the Discover panel.
-
However, after refreshing the browser or reopening Kibana, all counts are reset to zero.
-
Even if I check the
.kibana_*
system index, I can’t find any clear document that tracks the popularity values per field.
What I’d like to understand
-
How is the popularity count mechanism implemented?
-
Where is the popularity information stored (e.g.,
.kibana
index, browser local storage, session, etc.)? -
Is it updated automatically when users select fields in Discover, or only when saving a data view?
-
-
Why might popularity not persist or synchronize across users?
-
Is this expected behavior (user-local preference)?
-
Or could it be a misconfiguration or permission issue (e.g., lacking write access to data views in
.kibana_*
)?
-
-
Is there a way to make popularity counts persistent and shared among users?
- For example, to make the “popular fields” ranking organization-wide rather than per user/session.
Environment
-
Elasticsearch: 8.13.0
-
Kibana: 8.13.0
-
Security: enabled (
xpack.security.enabled=true
) -
Cluster type: self-managed (3-node Elasticsearch cluster on Docker: 1 coordinator, 2 data nodes)
-
Authentication: via
kibana_system
and organization users withkibana_admin
role
What I’ve tried
-
Checked the
.kibana_*
indices for documents containing field popularity info -
Verified user roles have
kibana_admin
andsuperuser
permissions -
Cleared browser cache and tested with different accounts
-
Restarted Kibana and reloaded the data view
Despite all these, popularity counts still reset or are isolated per user.
Question
Could someone explain:
-
How the “popular fields” mechanism actually works internally?
-
What conditions are required for popularity data to be written and persisted in Elasticsearch?
-
Possible reasons why the counts disappear or are not shared?
Any pointers to the relevant source code or documentation would also be greatly appreciated.