Rename fields inside Kibana in order to filter them in Dashboard

Good evening, I'm facing with the following issue, working on Kibana version 7.0.

I'm creating a Dashboard, where some visualization takes data from an Index and other visualizations takes data from other indexes...

The problem is that some fileds appear with different names when stored in different indexes.

For example, in a Index I have a field named "processname", and in another index the name of the same field is "processName". That result in an issue because, inside the Dashboard, filtering between the visualizations doesn't work.
For example, in the Dashboard I have a Bar Chart that keep data from the index where the field of interest is named "processname", and in the same dashboard there is even a "saved search" that list data from the index wich contains the field named "ProcessName". Obviously, when I select a bar inside the Bar Chart, filtering for "processname", the saved search become empty because no result is found. In fact, the name "processname" don't match with "processName".

So I need to make these fields communicate each other. I can re-create my indexes, but I can't re-create the visualizations (those are too much)... I need just to set up the solution inside Elasticsearch/Kibana.
I tried using Aliasing, but the filtering inside the Dashboard still not working. Is that a possible way? Can you please tell me if there is a way to rename all the field in the same way and make possible the filtering in the Dashboard, without broke the visualizations?

Thank you so much!

Hi @qttv

If you want one visualisation to filter another visualisation with a saved search they both need to be from the same index. What you probably want to do is reindex both indices to a new index (the same one). I guess that the mappings between the two indices that you mention are similar? As you will need to merge the mappings from those 2 indices.

When reindexing you will need to change the name of the fields, for that you will need a reindex with an ingest_pipeline using the rename processor.

Thank you,

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.