Switch between the "document" and "summary" columns in Kibana Discover

Elastic Stack Kibana
1

How to switch between the "document" and "summary" columns in Kibana Discover? In version 8.15, I saw "document," but in 8.16, I see "summary," and it is empty.

image
image1341×910 88.4 KB

The default column set to _source doesn't seem to take effect; only the fields within _source can be set.

Advanced Settings | Kibana Guide [8.16] | Elastic

defaultColumns The columns that appear by default on the Discover page. The default is _source.

2

Hi @debuggedme,

There is no switching between Summary and Documents. It should be working mainly the same as before.

Would it be possible to share with us an example of your data so we can debug this issue?

3

What data is needed? Here, I am using data stream to record log.

Below is a JSON document of one log

{
  "_index": ".ds-logs-xxx-2024.12.13-000007",
  "_id": "xxx",
  "_version": 1,
  "_score": 0,
  "_source": {
    "__container": "__container",
    "__pod": "__pod",
    "@timestamp": "2024-12-18T02:26:56.033Z",
    "__context": {
      "xxx": {
        "xxx": {
          "name": "name"
        }
      },
      "app_string": "xxx",
      "sampled_boolean": true,
      "grpc.method_string": "xxx",
      "traceid_string": "xxx"
    },
    "__cluster": "xxx",
    "__app": "__app",
    "__message": "xxxxxxxx",
    "__namespace": "xxx",
    "__level": "info"
  },
  "fields": {
    "__container": [
      "__container"
    ],
    "__pod": [
      "__pod"
    ],
    "__app": [
      "open-match"
    ],
    "__level": [
      "info"
    ],
    "__context.app_string": [
      "xxx"
    ],
    "data_stream.type": [
      "logs"
    ],
    "@timestamp": [
      "2024-12-18T02:26:56.033Z"
    ],
    "__context.grpc.stream.request.content_object": [
      {
        "xxx": {
          "xxx": {
            "name": "name"
          }
        }
      }
    ],
    "__context.grpc.method_string": [
      "xxx"
    ],
    "__cluster": [
      "xxx"
    ],
    "__message": [
      "xxxxxxxx"
    ],
    "__context.traceid_string": [
      "xxx"
    ],
    "__namespace": [
      "xxx"
    ],
    "__context.time_string": [
      "2024-12-18T02:26:56Z"
    ],
    "__context.sampled_boolean": [
      true
    ]
  }
}
4

Thanks! What mapping do you have for this data?

Are there any errors logged in the browser console?

Is Summary empty for all rows? Can you see fields data in the flyout when expanding one of the rows?

5

All rows are empty, and the log overview is as shown in the image. However, there is data in both the Table and the JSON.

image
image548×812 16 KB

The few lines of logs from the console are as follows:

discover#/? g=(filte.estamp'desc))):178 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'report-sample' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-Vf/5lhWIh6ub3ANk6a6rqRaf7x7HUixyrKDFs2axDL0='), or a nonce ('nonce-...') is required to enable inline execution.

bootstrap.js:42 ^ A single error about an inline script not firing due to content security policy is expected!
core.entry.js:16 Native global console methods have been overridden in production environment.
6

Hooking into this one since we are experiencing the same ( see thread What happened to the logs explorer? - Elastic Stack / Kibana - Discuss the Elastic Stack)

7

Thanks, @debuggedme!

It's a bug and we will work on a fix for it. Opened a ticket here [Discover] Summary column should not filter out mapped fields which start with `_` · Issue #204771 · elastic/kibana · GitHub

In this case Summary column is empty because field names start with _.

A workaround to see the data would be to add individual fields from the fields sidebar so they are rendered as separate columns in the grid.

Sorry for the inconvenience and thanks for reporting the issue!