recently I upgrade my ELK stack from version 5 to version 6(.4).
My documents contains a field which is a JSON object and until now, the JSON's attributes were shown in Kibana's discovery UI as seperate fields (as shown in the following screenshot)
After the upgrade, the JSON object is not split into several fields but shown as a single object. I don't have a clue why this is happening.
The data is incoming via Logstash and it just parses a incoming String to a JSON object, like this:
source => "message"
target => "message"
But this was not changed - so it was done like this before.
The mapping is also the same as before. Is there something like an option where I can specify Kibana's behavior in this case?
Appreciate any help