OpenSearch-Dashboards icon indicating copy to clipboard operation
OpenSearch-Dashboards copied to clipboard

[Feature Request] Field list does not reflect all the available fields for the selected index.

Open tibz7 opened this issue 2 years ago • 11 comments

Describe the bug In Discover not all the fields present in the index pattern are present. For instance one of my field (log_level) is in the dataset (and mapped in the index pattern), but it does not appear in the list of available fields. however If if filter using this field it works.

These issues are a bit different, but somehow similar, it feels to be a general UX problem about displaying information . I write them here, if you think that I should open a separate issue for these, I will.

  • When i click on that field, the small pop-up opens, with 5 top values. but only one value is shown, while more than one is present in that time frame. I assume it is because of its recurrence: there were more occurrences of INFO than WARN, so only INFO is shown. This is very confusing as even if its 2% I expect to see WARN as well.

  • it happens often that in some places were you should select some indices/index patterns (like index management), not all the indices are shown. For instance only those starting with .security are show. If you type my-index it works, but the select does not suggest you my-index as you type. This is also very confusing. The "available indices" seems to be very randomly displayed. For example Some selects will show you the ones starting with .security some with .kibana

To Reproduce Steps to reproduce the behavior:

  1. Go to Discover
  2. Click on your index pattern
  3. Search for one of your field.
  4. some fields are presents in available fields, some others not.
  5. filter with an "non present field" ... it works!

Expected behavior I would expect to see all the fields present in that index pattern

OpenSearch Version 2.7

Dashboards Version 2.7

Additional context The index pattern where I noted the bug is an index pattern grouping other index patterns with different fields. IIn one index patterns fields are starting with php_ in the other some with nginx_. I don't know if thats a coincidence or not, but I assume it worth to be mentioned. Each of the index dont have many fields, maybe 8 each. I dont have an index with say 16 fields to see if thats a display problem due to the number of fields.

tibz7 avatar Jun 29 '23 15:06 tibz7