Issue with Columns Resetting in Log Explorer (PPL) on Opensearch Dashboards v2.15.0

OpenSearch Dashboards
, ,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

  • OpenSearch Dashboard : v2.15.0
  • OpenSearch Cluster : OpenSearch Dashboards indicates compatibility with version 7.10.2 (AWS OpenSearch Service).
  • Browser : Google Chrome 131.0.6778.19 (Official Build) (64-bit)
  • OS : Windows 10 Enterprise

Describe the issue:
In the Log Explorer feature under Observability, when executing PPL queries, selected columns reset to default (Time and Source) after every new execution of the query. This issue occurs in the following scenarios:

  1. When selecting additional columns (e.g., message, loggerName) and clicking “Run,” the view reverts to default columns after the execution.

When saving a Log Explorer with custom columns and retrieving it later, the initially saved columns appear briefly but are replaced by the default ones (Time and Source) within a second.

Steps to reproduce:

  1. Open Log Explorer and connect to a data stream (e.g., logs-XXXXX).
  2. Run a PPL query like:

source=logs-XXXXX

  1. Add custom columns (e.g., message, loggerName) to the view.
  2. Click “Run” or save the explorer view.
  3. Notice that the custom columns are reset to default (Time and Source) after execution or when reloading the saved Log Explorer.

Expected behavior:
The selected or saved columns in Log Explorer should persist after query execution or when reopening a saved view.

Configuration:
The issue was observed on a data stream with an active ingest pipeline that indexes fields from the message field. Queries like source=logs-collection-provider work, and columns such as loggerName and message are correctly indexed and searchable in Discover.

Relevant Logs or Screenshots:
Screenshots show columns message and loggerName initially appearing in the view but resetting to default after execution. Logs Explorer shows no errors during query execution.

Additional Details:
The same data stream works flawlessly in Discover, Visualize, and Dashboards.
Could this be related to the implementation of Log Explorer or PPL in Dashboards?

Thanks in advance, Best regards.

NOTE:
Panel with two added columns:

PPL_fields_initial
PPL_fields_initial1716Ă—786 79.8 KB

Panel after running the query or retrieving the previously saved panel with two added columns:

PPL_fields_final
PPL_fields_final1623Ă—705 80.4 KB

2

@mpicallo It looks like a bug. I’ve got the same results in 2.18.0.
There is an interesting behaviour with saved queries. When the page is loaded, I can see the saved column layout for a very short time, and then it is overwritten by the default layout.

Could you report it as a bug in OpenSearch GitHub?
I haven’t found any bugs reported regarding this problem.

Once you create the issue, please share the link here.

3

@pablo
Thank you for confirming the issue. I have created the bug report as requested:

Best regards,

1 Like