IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« High RSS memory usage due to MADV settings Appendix A: Contribute to Beats »
Elastic Docs ›Packetbeat Reference [8.14] ›Troubleshoot ›Common problems

Fields show up as nested JSON in Kibana

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Fields show up as nested JSON in Kibana

edit

When Packetbeat exports a field of type dictionary, and the keys are not known in advance, the Discovery page in Kibana will display the field as a nested JSON object:

http.response.headers = {
        "content-length": 12,
        "content-type": "application/json"
}

To fix this you need to reload the index pattern in Kibana under the Management→Index Patterns, and the index pattern will be updated with a field for each key available in the dictionary:

http.response.headers.content-length = 12
http.response.headers.content-type = "application/json"
« High RSS memory usage due to MADV settings Appendix A: Contribute to Beats »