Kibana: Hide missing fields in Visualize's field drop down

[DannyBen]

When building a Terms visualization from a saved search, the Field drop down list contains all the fields, even ones that do not exist in any of the records of that saved search.

It will be useful if these fields are hidden - like the equivalent Hide Missing Fields feature that exists in the Discover tab.

[rashidkpc]

Unfortunately we don't know which are present. In discover we loop through all of the _source's and create the list, we don't have access to that in visualize. In addition many fields in elasticsearch are not visible, but are aggregatable, eg anything that comes through logstash with a .raw attached.

[rashidkpc]

Leaving this open as a feature request, perhaps elasticsearch could implement a way to return all of the fields that are available for some query

[DannyBen]

Ok. And a closely related question:

In the Fields dropdown, the fields are categorized into Date, Number, String etc.
What happens if the same field contains different types in different logs? Will it safely fall down to "String"?

[rashidkpc]

No, we'll remove it entirely from the list. We require that field types do not conflict at index creation time. If you change the format later you'll need to refresh your index pattern. If type conflict we will remove them from the list.

[DannyBen]

Understood, thank you.
This makes it more tricky to push different log types, need to be careful to avoid conflicts.

[cphoover]

What about using a searchable fields dropdown... Using the select2 plugin

https://select2.github.io/examples.html

This would help with having tons of fields.

[blfrantz]

Absolutely agree with cphoover's request for a searchable fields drop-down. Seems like an easy thing to add and would make things a lot easier for us (we have a ton of fields).

[timroes]

We nowadays have a searchable field selector as requested in the last two comments. Since our index patterns are linked to the mappings we get from Elasticsearch as Rashid already mentioned, I will close this, since we don't need to keep a ticket open for a potential Elasticsearch feature :-)