Property not available for visualize in kibana

Question

While trying to change a Visualization in Kibana to use another property for the x-axis, that property doesn't appear there.

I changed recently nlog to target elastic search using the Elastic common schema.

After that change the property is not longer called ResolvedRoute but instead _metadata.resolved_route, the problem is that it doesn't appear on the field for x-axis, it says no matches found.

It is not on the available fields

I'm still new to elastic search and kibana, so it's possible i'm missing something simple.

Don't know if it's related, but when on Discovermenu, looking at the Available fields all of _metadata fields have a question mark

I'm already trying to map some of these fields in Index Management / Edit template

Also, if i go to the console and type

GET /logstash-2020.11.25/_search
{
  "query": {
    "match_all": {}
  }
}

I can see the fields of _metadata that i want, inside _source which is inside of hits.

I think i already had a similar problem where i had to delete all indexes that match the pattern and then the field appeared, but that doesn't make much sense.

What could be the problem?

Answer 1

The fields in question were not correctly mapped in the template.

since metadata is an object it needs to be mapped like that first, then inside of it we can map it's own properties.

Answer 2

Chances are high that you haven't refreshed the corresponding index pattern in Kibana. Therefore the data might exist as documents in Elasticsearch but not yet as a field in the index pattern, which is a Kibana Saved Object.

Please go to Settings / Stack Management (depending on your Kibana version), click on the index pattern you expect the field to be in and refresh the fields list (icon is in the upper right corner).

Please let me know if that solved your problem.