Unable to view fields in kibana

(Sripal) #1

Hi All,

I am unable to view the fields in kibana.

For the time Jan 1 to 31 the following fields are visible

But for the same index from Jan 2 14:54:00 to Jan 2 15:00:00, I am able to see the all fields

  1. err_number
  2. error_msg
  3. nagios_epoch etc...

My queries:

  1. Why i am unable to see the fields "err_number", "error-msg" while selecting whole data?
  2. If not how do i find the same.( i know there is error on Jan 2 14.54:00 ) If i am unaware of the error time how do i find the fields "err_number", "error-msg"

Please help

(Sripal) #2

(CJ Cenizal) #3

The list of fields should display the accumulation of all fields for all documents which match your query. If one of your queries has a filter on it but the other does not, it's possible that you will retrieve a set of documents with different fields. Can you confirm that the same filters are applied to all of your screenshots?

(Sripal) #4

Hi @cjcenizal,

Thank you for your response.
The search query is same for all the results, only the time difference.

  1. I am able to view all the fields for the particular time period "Jan 2 2019 14:00:00 to Jan 2 2019 16:00:00"
  2. Just i select the time period from "Jan 1 2019 00:00:00" to "Jan 31 2019 23:59:59"

I am unable to view all fields(which comes in the earlier query). Its showing only the major fields.
I think its a unexpected behavior. Could you please help me on this.


(Sripal) #5

Hi @cjcenizal

I am just sharing the screenshot of the query results again.

  1. Query result for the Time Period "Jan 2 2019 00:00:00 to Jan 3 2019 23:59:59 "

  2. The same query for the Time Period "Jan 2 2019 14:54:00 to Jan 2 2019 15:00:00"

(CJ Cenizal) #6

Hi there, this definitely looks like a bug to me. I would expect all of the same fields from one query to be available in a broader query. Could you please submit a bug report?


(Sripal) #7

Hi @cjcenizal,

Raised a bug # 30783


(system) closed #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.