# Why does Kibana displays the same json data (both in content and structure) in a different way depending on the filtering?

**URL:** <https://discuss.elastic.co/t/why-does-kibana-displays-the-same-json-data-both-in-content-and-structure-in-a-different-way-depending-on-the-filtering/190656>\
**Category:** Kibana\
**Created:** [July 16, 2019, 6:47am UTC](https://discuss.elastic.co/t/why-does-kibana-displays-the-same-json-data-both-in-content-and-structure-in-a-different-way-depending-on-the-filtering/190656 "2019-07-16T06:47:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kensaku-okada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kensaku-okada/32/51478_2.png) [@kensaku-okada](https://discuss.elastic.co/u/kensaku-okada)\
**Post date:** [July 16, 2019, 6:47am UTC](https://discuss.elastic.co/t/why-does-kibana-displays-the-same-json-data-both-in-content-and-structure-in-a-different-way-depending-on-the-filtering/190656/1 "2019-07-16T06:47:50Z")

</div>

I am updating the logstash.conf file as the communication protocol changes in my system from Lumberjack to HTTPS.

With Lumberjack, one of the log items called "host" is formatted as:

> "host": {  
> "name": "some\_host\_name"  
> },

On the other hand, With HTTPS it is formatted as:

> "host": "some\_host\_name"

So I reformatted the latter into former using the following mutate command as suggested at [How to add nested log data or replace string values with nested log data on logstash.conf?](https://discuss.elastic.co/t/how-to-add-nested-log-data-or-replace-string-values-with-nested-log-data-on-logstash-conf/190222).

> if "name" not in [host] {  
> mutate { rename =\> { "[host]" =\> "[@metadata][host]" } }  
> mutate { add\_field =\> { "[host][name]" =\> "%{[@metadata][host]}" } }  
> }  
> }

This command successfully modified the log data and inserted into Elasticsearch. However, Kibana displays the data in a different way somehow (see the element of "host" and "host.name"). As the "\_id" shows, these are exactly same log data. The only difference is that the ranger of filtering on Kibana (eventlog-\* and -_). I am guessing, when filtering by eventlog-_, no data inserted by HTTPS (and its reformatting) would included in the search result, and when filtering by -\*, some of them would be included, but I do not know what internal mechanism makes such difference even thought JSON data is totally same.

 ![Screenshot%20from%202019-07-16%2015-00-48](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92b15cd2f00766804c8d1a36ba5fcd7be0ccb30b.png) ![Screenshot%20from%202019-07-16%2015-02-06](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40a5067c3ed7a588ca5bbc84d570b2df3f98fba3.png) ![Screenshot%20from%202019-07-16%2015-02-41](https://us1.discourse-cdn.com/elastic/original/3X/b/a/bae4361f82aa3217a49440fdf9ce84bc6e31bdbc.png) ![Screenshot%20from%202019-07-16%2015-02-56](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44775b96c5fd0cc87be6bff0ecce5f8995d0b3e6.png)

I do not think this difference would make any trouble due to the format gap cus it is same in json, but could you tell me why/how this happens, and if there is, any potential error for this discrepancy on CRUD data manipulation?

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [July 18, 2019, 12:45pm UTC](https://discuss.elastic.co/t/why-does-kibana-displays-the-same-json-data-both-in-content-and-structure-in-a-different-way-depending-on-the-filtering/190656/2 "2019-07-18T12:45:26Z")

</div>

Can you verify with and Elasticsearch query that the mutate filter works? From what i can see in how the data is displayed in Kibana, it looks like it never enters that IF branch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 12:45pm UTC](https://discuss.elastic.co/t/why-does-kibana-displays-the-same-json-data-both-in-content-and-structure-in-a-different-way-depending-on-the-filtering/190656/3 "2019-08-15T12:45:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.