Shared Cluster - Nested Object Not Showing Child Objects

I have a shared cluster that ties into multiple client clusters and I'm trying to create a dashboard to show geo information from them all but in the table view the child fields under geoip such as geoip.country_name are not showing as individual fields. They show just as one { } block as in the screenshot. If I view it under the json tab, it looks correct. If I go to the original cluster, it is correct there under the table view. I have tried to refresh and recreate the index mappings but no change. Under the mappings this specific field has a type of unknown. I can do a search for these fields like geoip.country_name:"United States" but can't add specific fields to a table visualization.

Any suggestions to get this to map like regular fields?


Another engineer upgraded our Logstash and we think that's why this isn't showing properly now. We are upgrading Kibana soon and will see if that fixes this.

It sounds like the mapping on Elasticsearch side is not set up correctly. Could you share the mapping here?

Execute the following in the console:

GET myIndexName/_mapping

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.