elasticsearchkibanaelastic-common-schema

Property not available for visualize in kibana

While trying to change a Visualization in Kibana to use another property for the x-axis, that property doesn't appear there.

I changed recently nlog to target elastic search using the Elastic common schema.

After that change the property is not longer called ResolvedRoute but instead _metadata.resolved_route, the problem is that it doesn't appear on the field for x-axis, it says no matches found.

It is not on the available fields

enter image description here enter image description here

I'm still new to elastic search and kibana, so it's possible i'm missing something simple.

Don't know if it's related, but when on Discovermenu, looking at the Available fields all of _metadata fields have a question mark

enter image description here

I'm already trying to map some of these fields in Index Management / Edit template

enter image description here

Also, if i go to the console and type

GET /logstash-2020.11.25/_search
{
  "query": {
    "match_all": {}
  }
}

I can see the fields of _metadata that i want, inside _source which is inside of hits.

I think i already had a similar problem where i had to delete all indexes that match the pattern and then the field appeared, but that doesn't make much sense.

What could be the problem?

Solution

  • The fields in question were not correctly mapped in the template.

    since metadata is an object it needs to be mapped like that first, then inside of it we can map it's own properties.