error with disabled _source field

[wolframhaussig]

Hello,

Because of larger fields in the log entry I have disabled the _source field. Now, logtrail shows the following error and I cannot see the data in logtrail:

Error while executing search TypeError: Cannot read property 'USER_DATA' of undefined at convertToClientFormat (/logserver/applications/kibana-6.5.4-linux-x86_64/plugins/logtrail/server/routes/server.js:72:19) at /logserver/applications/kibana-6.5.4-linux-x86_64/plugins/logtrail/server/routes/server.js:209:17 at bound (domain.js:301:14) at runBound (domain.js:314:12) at tryCatcher (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/util.js:26:23) at Promise._settlePromiseFromHandler (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/promise.js:503:31) at Promise._settlePromiseAt (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/promise.js:577:18) at Promise._settlePromises (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/promise.js:693:14) at Async._drainQueue (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/async.js:123:16) at Async._drainQueues (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/async.js:133:10) at Immediate.Async.drainQueues (/logserver/applications/kibana-6.5.4-linux-x86_64/node_modules/bluebird/js/main/async.js:15:14) at runCallback (timers.js:810:20) at tryOnImmediate (timers.js:768:5) at processImmediate [as _immediateCallback] (timers.js:745:5)

The field exists and can be queried in Kibana. I use Version 6.5.4 of Kibana/Elasticsearch and v0.1.30 of LogTrail.

[sivasamyk]

@wolframhaussig logtrail assumes the fields are present inside _source. I will check how Kibana handles the docs when the source field is not present. Meanwhile, you edit this https://github.com/sivasamyk/logtrail/blob/master/server/routes/server.js#L49 line to remove _source and directly query the response.

[wolframhaussig]

@sivasamyk Thanks a lot! I will use the workaround for now.