Unfortunately Kibana doesn't provide much tooling around "doing something for every field".
The best approach I can think of is to build the following visualization:
- For rows, use a Filters function with these filters:
field2: * and so on for all 1500 fields, you get the idea
- For metric, use a unique count of
This will give you a table like this:
| Field filter | number of event codes |
AllowedToDelegateTo: *, | 2|
It's annoying to type 1500 filters like this, you might be able to automate this part by doing the first two field filters, then saving the visualization to the library, exporting the saved object via saved object management which will give you a json file, then write a script which will create all of the necessary filters.
Another approach would probably require more work (and might not be feasible depending on data volume) - it would require splitting up your documents. Instead of a single document like this:
ingest one document per field like this:
Then you can do a top values on
key with a unique count on
eventCode to get the same information.