Scripted fields not showing up in Kibana

[Douglas_Muth]

Hi,

Relatively new to ELK, and I am trying to use it to perform data analytics on Philadephia's pubic transit system. I have access to their API and have no difficulty ingesting the data, but where I am running into problems is with scripted fields. I've never used them before, and decided to try creating a test test fields, as shown below:

However, the scripted fields aren't showing up like I expect they would:

I checked the javascript console as well, and don't see any errors. About the only clue I have is when I check the request field:

{
  "version": true,
  "size": 500,
  "sort": [
    {
      "@timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1m",
        "time_zone": "America/New_York",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    "@timestamp"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1521512763868,
              "lte": 1521513663868,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

What's interesting to note there is that the script_fields field is empty. I would have expected there to be something in there.

Can anyone point me in the right direction on this? Anything I can check? Anything I should look at? I've been Googling for the greater part of the last hour, and I'm out of ideas.

(This is with Kibana 6.2.2, BTW)

Thanks,

-- Doug

[Bargs (Matt Bargar)]

That's pretty strange, I've never seen this issue before.

Let's check what the index pattern looks like when it's loaded in from the server in Discover. Open the network tab of your browser's devtools and reload the Discover page. You should see a request that looks like this:

Look at the fields attribute of the index pattern in the response and let me know if you see your scripted fields in there.

[Douglas_Muth]

So I sort of have an update--I spent some more time playing around with scripted fields after writing this post, and at one point when re-loading the scripted fields page, all 3 of my scripted fields disappeared. That was strange.

So I re-added them, and discovered that they began showing up in the Discover view. That's kinda strange, and I have no further explanation for it.

I did check in the console as you suggested, and did see the scripted fields in question, of course now that they're displaying in Kibana proper, I don't think that will help us much.

This is on my dev system, and I have more work to do, so if I can reproduce this problem, I will follow up here.

Thanks!

-- Doug