# Separate Fields Now Displaying As One Object **URL:** \ **Category:** Kibana\ **Created:** [January 10, 2022, 10:00pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950 "2022-01-10T22:00:22Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 10, 2022, 10:00pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/1 "2022-01-10T22:00:22Z")
I use Logstash to process our logs and organize relevant fields into objects so that they display together in Kibana. ```auto log.source log.format log.time ``` However, after upgrading, I THINK to 7.16, they're now displaying as an object under the root field `log` in JSON. ```auto { "format": "", "source": "", "time": "" } ``` When did this happen? Is there a setting I can change or do I have to completely re-write my Logstash pipelines to put them in separate fields? ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [January 11, 2022, 8:01am UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/2 "2022-01-11T08:01:30Z")
Could you share the mapping of your index? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 11, 2022, 3:05pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/3 "2022-01-11T15:05:22Z")
```auto "log": { "properties": { "format": { "type": "keyword" }, "time": { "type": "date" }, "source": { "type": "keyword" } } }, ``` ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [January 11, 2022, 3:06pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/4 "2022-01-11T15:06:23Z")
This is should work fine, can you share a screenshot of the problem? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 11, 2022, 3:23pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/5 "2022-01-11T15:23:41Z")
The fields in my previous example aren't real data, but below is the same problem with real data. ```auto "action": { "properties": { "detail": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "endpoint": { "type": "keyword" }, "method": { "type": "keyword" } } }, ``` **Kibana Screenshot** ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7a7b470dbecb98995dc8e90028b5fefca6e0b1dd.png) ---
**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Post date:** [January 11, 2022, 4:19pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/6 "2022-01-11T16:19:23Z")
What happen when you reload the kibana page? The mappings are the same across all the indices contained in the index pattern? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 11, 2022, 4:21pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/7 "2022-01-11T16:21:20Z")
Same behavior reloading the page. I've deleted all the related indices to eliminate the possibility of data type mismatch. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 11, 2022, 9:54pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/8 "2022-01-11T21:54:51Z")
For Elasticsearch, this; ```auto log.source log.format log.time ``` Is the same as this; ```auto { "log": { "format": "", "source": "", "time": "" } } ``` So Kibana is just displaying them differently, but to Elasticsearch there's no change. ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [January 12, 2022, 8:49am UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/9 "2022-01-12T08:49:03Z")
> [@wwalker](#): > > ```auto > "action": { > "properties": { > "detail": { > "type": "text", > "fields": { > "keyword": { > "type": "keyword" > } > } > }, > "endpoint": { > "type": "keyword" > }, > "method": { > "type": "keyword" > } > } > } > > ``` Are you sure all indices in your index pattern have this mapping? I'm guessing there is a conflict and some index has another mapping. I tested the following on 7.16: ```auto PUT actionindex { "mappings": { "properties": { "action": { "properties": { "detail": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "endpoint": { "type": "keyword" }, "method": { "type": "keyword" } } } } } } POST actionindex/_doc { "action": { "detail": "a test", "endpoint": "the_endpoint", "method": "the_method" } } ``` This is how it looks like in discover (all fields are recognized correctly): ![Screenshot 2022-01-12 at 09.48.17](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2df9749db34c693c268a13aa16f15010f0d31d6.png) ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 12, 2022, 10:44pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/10 "2022-01-12T22:44:20Z")
I stopped Filebeat on the remote server that pushes the logs, deleted all indices, the index template, the index pattern from Kibana/Elasticsearch, and restarted the pipeline to push a fresh copy of the template into Elasticsearch. Still getting the same appearance in Kibana. **JSON snippet of event** ```auto { "_source": { "timestamp": "2021-12-30t11:11:39.722296", "action": { "detail": "", "endpoint": "/validate/check", "method": "post" }, ``` **Table view of event** ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cb8197fcdcb4be82deecfe20a7f50035a82bf9b7.png) **Index Template Configuration** ```auto "action": { "type": "object", "properties": { "detail": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "endpoint": { "type": "keyword" }, "method": { "type": "keyword" } } }, ``` ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [January 12, 2022, 10:47pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/11 "2022-01-12T22:47:33Z")
I just discovered the cause of the issue, which may be a regression bug. When the option "Discover fields from source" is enabled, it causes the unwanted behavior. Once I disabled this setting, the fields started displaying properly. However, I enabled this option in the past because not all fields were being displayed in my indices in the past. Hoping that problem has been fixed... ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [January 17, 2022, 3:25pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/12 "2022-01-17T15:25:33Z")
Just wanted to add that I've reproduced and opened an issue for this case: [[Discover] Using \_source fields of objects are no longer displayed separately · Issue #123169 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/123169) thx a lot for reporting! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 14, 2022, 3:26pm UTC](https://discuss.elastic.co/t/separate-fields-now-displaying-as-one-object/293950/13 "2022-02-14T15:26:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.