Fields missing in Observability->Logs, but present in Discover?

OpenSearch Dashboards
1

Versions (latest):

Hello, new to Opensearch. I’m facing an issue that within the Logs section of the dashboards I do not see many of the fields I can otherwise view when looking at my source in Discover. I have the fields present in index patterns. I want to use security features of Opensearch for some alerting and detection, but my current detectors that use fields and values from the fields that are not displayed do not work.

image
image489×1033 43.7 KB

Can only upload one screenshot, but basically the fields that have starting with context (context.affected_user_is_support) are absent in the Logs explorer.

Running Opensearch in Docker per the documentation guide.

2

@slowdashbash Could you share the screenshot of the OpenSearch Dashboards UI where you expect to see all of the fields?

3

image
image601×1081 38.6 KB

I dont see any of my context fields in the Logs section. Curious why.

4

@slowdashbash I’ve got the same result. However I see the data of the nested fields. If you check the context field, you’ll notice that all nested fields are there.