I am logging my exceptions and adding my strack trace to as
error.stack_trace when I display this I use
error.stack_trace.keyword. I can see my old entries fine but I can not see any new stack_traces. If I use the discover functionality I can see them all under
error.stack_trace but not under
error.stack_trace.keyword. Is there something that I need to do to make sure my string entries gets “keyworded” automatically?
You can check the mappings of the index to see if the field
error.stack_trace.keyword exists, you may add the field’s mapping to the index template(if not exist you can create one) to make sure that every new index contains that field.
That does not seem to be it. It seems that some of the logs with
error.stack_trace get properly handled and get the
error.stack_trace.keyword entry but not all.
You mean that in Discover you want to see the value of the
.keyword subfield? I don’t think you can do that normally, because subfields aren’t stored in
_source, you only get the parent field (in your case,
Though the API, you can get the contents of the
.keyword subfield by default if you ask for it in
Not quite. I mean that when I filter in the Discover view on
error.stack_trace.message not everything from
error.stack_trace shows. Especially newer message doesn’t have the
I don’t quite get how your mapping looks like. Can you share a relevant snippet?
Hi again! Sorry for the incredibly late response, have been busy with other parts of this project.
I think the mapping looks like it should.
When I search in Discover for
error.stack_trace.keyword: exists I get 2 hits vs 74 hits for