Table in kibana doesn't show multiple keyword values when an array

Elastic Stack Kibana
1

Gooday,

I have a field named network_impacts

The field is mapped as a keyword and can have a single value or a list of values

In the table view on kibana, I'm observing that the table will only display a single value in the list when there is multiple rather than the entire list

I have tried to create a runtime field that would unpack the list to a string, but it seems there is issues with type casting that I have been unable to resolve

Any ideas?

3

@cassius_au_bellona do you have the ability to provide an example of the value(s)? Please do not post real values. :grinning:

Also, are you referring to the "Table View" in Discover or a table visualization?

4

Yes,

e.g. consider you have a keyword-defined field named network_impacts

and inside the index, the data is sometimes a single keyword (string) and in other records, it is an array such as [value_1, value_2, value_3]

in a dashboard using lens, we have created a table visualization, we added the field network_impacts to the rows, and then used the top values function with the number of values set to 1

if I increase the number of values I will see multiple rows of the same record but with different values for the network_impacts field

from a user perspective, this is confusing and thus I wanted a single row to represent a single record in the index

but I wanted the table visualization to show the full list of values rather than just value 1 or one of the other values in the list

I tried to create a runtime field to unpack the list to a string, but I ran into type-casting issues in the 'painless' language and I was not able to make progress beyond that

I don't mind providing screenshots if that helps..

5

If you could provide screenshots and a data example it would help a lot.

On my quick test I did the following on the console to create a sample dataset:

# Create an index with a single keyword field
PUT discuss-365622
{
  "mappings": {
    "properties": {
      "key": { "type": "keyword"}
    }
  }
}

# Add data to the index with single 
# and array values to the keyword field
POST discuss-365622/_bulk
{ "index": {}}
{ "key": "a" }
{ "index": {}}
{ "key": "b" }
{ "index": {}}
{ "key": "c" }
{ "index": {}}
{ "key": ["a", "b"] }
{ "index": {}}
{ "key": ["c", "d"] }
{ "index": {}}
{ "key": ["a", "b", "c"] }
{ "index": {}}
{ "key": ["a", "b", "d"] }
{ "index": {}}
{ "key": ["b", "c", "d"] }

# Check the data
GET discuss-365622/_search

# Create a data view for the index
POST kbn:/api/data_views/data_view
{
  "data_view": {
    "title": "discuss-365622"
  }
}

Then, a Lens table shows what I think is the correct data rendering for the default function and settings:

image
image958×503 30 KB

This is all on the 8.15 version of the Elastic stack, but I'm confident it should yield similar results in older versions as well.

Is this table the expected outcome on your end? If that's the case, how is the input data different from yours?

Hope it helps!

6

If you are using Last value to display your keyword values, then make sure to enable Display array values to show multi values from the field:

Screenshot 2024-08-28 at 14.51.50
Screenshot 2024-08-28 at 14.51.50638×628 32.5 KB

7

This ended up being a solution..

create a runtime field defined as a keyword and set the value as:

def result = "";
 
for (def i=0; i < doc['network_impacts'].size(); i++) {
    if (i > 0) {
        result += ", " + doc['network_impacts'][i];
    } else {
        result += doc['network_impacts'][i];
    }
}
 
emit(result);