Why does a kibana lens pretend my fields have no data, when they clearly do?

[gcanyon (Geoff Canyon)]

1. I click on kibana
2. I click on visualize
3. I click on Create visualization
4. I click on Lens
5. The left column, under "Individual fields" says: "Looks like you don't have any data. Try extending the time range"
6. I see that I am looking at the last 15 minutes of data -- I change this to a week and still see the issue.
7. The left column also says: "Use filter by type to show fields without data."
8. I click "Filter by type" and deselect "Only show fields with data"
9. A bunch of fields now display. I drag one into the central area, and it displays a bar chart, clearly based on the data in that field.

Why would the interface act this way? Am I fundamentally misunderstanding what "without data" means? Is there a documentation page for this?

[stephenb (Stephen Brown)]

Hi @gcanyon Welcome to the community

What version are you on?
Have you made any changes in the Kibana advanced settings ?
Did you select the correct index pattern?

What kind of index is this logs metrics or custom?

[gcanyon (Geoff Canyon)]

I once spent an hour trying to figure out what version I was on, because an example I found on the web didn't match. An hour later I gave up just trying to find the version number

If you mean advanced settings at the install-elastic level, I didn't install it, so I don't know. In my web-instance of kibana I have changed no settings.

I haven't selected any index pattern/data view as far as I know -- I literally followed the steps I described.

I don't know what the kinds of indexes are.

And thanks for the response.

[stephenb (Stephen Brown)]

Navigate
Kibana -> Stack Management will show the version.

Select Index Pattern in Lens

Try This

Or Perhaps this

How-to Series: Kibana

Pr This

Getting Started with Kibana

Or you could add the sample data and try that.....

[gcanyon (Geoff Canyon)]

7.8.0

Can I just ask: why would this be called "Stack Management" instead of "About Elasticsearch" like every other application since GUIs were invented? Sorry to be testy, but I really did spend an hour at one point just trying to get this one piece of information, and since something like 2/3rds of the results in google refer to the command line curl command, and 80% of the rest of the results point to the command console, and the commands given are forbidden for me, ¯\(ツ)/¯

I already had the index pattern selected -- which, is there a document that translates this for people with years of SQL experience? -- I'd love to know that "table" == "index pattern" -- assuming that even is true.

I can't do any of the try this items because of the issue I described: no fields are available, because kibana thinks they're all empty:

If I open "Filter by type" and deselect "Only show fields with data" then all my fields appear. And they do have data -- from that point on I can drag them into the display and report on the data they very much do contain.

[stephenb (Stephen Brown)]

So you're probably not going to like to hear this but 7.8 is pretty old and early in the Lens functionality.

You can think of an index as a table if you like. It's a reasonable analogy.

I don't know why you're seeing what you're seeing. I haven't looked at 7.8 in a long time but I do know that some of the field population etc there perhaps were some bugs back then.

There is a concept of index patterns which Lens uses and there were some different ways they were generated and displayed back in 7.8.

You could try going under stack management, index patterns and and find the index pattern you're using which you did not show me.

Refresh the index pattern.

Then go back to lens and do a full reload of the page shift refresh I think is the right way to think about it.

Then see if you're seeing the same behavior

[gcanyon (Geoff Canyon)]

Thanks for the reading material -- neither url can be reached right now, but I'm prepared to assume that's because of some firewall aspect of my office's network. I'll check again when I get home, hopefully with better results.

I will say that it's frustrating that you and I are on seemingly the same major version, and your UI looks dramatically different than mine. The functionality is (pretty much?) the same, but seemingly arbitrary changes to the look and feel makes it more difficult to follow along.

[gcanyon (Geoff Canyon)]

No worries about the version. I don't have index patterns under stack management. I have index management, which I don't have privs for.

[stephenb (Stephen Brown)]

So with the elastic Stack it is often said that each minor release is equal to most software vendors major releases. So your ~9 versions behind... And Lens is one of the most iterated on capabilities over that time frame It's become a major capability for the Kibana.

In addition, over that time frame, there's been a significant improvements of how field and field types are loaded. Think of the schema. It's much more dynamic the loaded now whereas before it was statically loaded, It's possible your index pattern is out of date and thus it's not showing correctly in lens That was an old behavior

I'm just the messenger

Further down under stack management should be index patterns That is not in the same place as index management.

What is the name of the index pattern that you're using in Lens.

[Marta_Bondyra]

Hi there, Lens-team member here.
Stephen is right, you're likely running into this issue: Lens showing empty field when there is data · Issue #89716 · elastic/kibana · GitHub
So if you have no way of upgrading the Kibana version:
as mentioned in the issue, even if the fields list is giving you wrong results, the whole app should still work correctly. Just use empty fields (that are not empty in your case) and drag them to create a visualization. It will be working fine.

Sorry about it, this is a complex topic and we've improved a lot here over the versions.