as seen in the image below, not all documents have values been displayed for fields on the table
If we take second row, it may seem that it only has source.ip: 49.232.244.108 and session.id: 4836129 and no values for fgt.srcip and fgt.sessionid. However, that is impossible because source.ip is a copy of fgt.srcip and session.id is a copy of fgt.sessionid
If we filter just that document we see that it does have both fgt.srcip and fgt.sessionid, but json is not expanded on view like other object fields.
We can use fgt.srcip and fgt.sessionid for search and the search works, but it does not expand the json either
The behavior is random, running the query again and again and I get a different display everytime. Sometimes it expands some fields, sometimes others
as seen in the image below, not all documents have values been displayed for fields on the table
If we take second row, it may seem that it only has
source.ip: 49.232.244.108andsession.id: 4836129and no values forfgt.srcipandfgt.sessionid. However, that is impossible becausesource.ipis a copy offgt.srcipandsession.idis a copy offgt.sessionidIf we filter just that document we see that it does have both
fgt.srcipandfgt.sessionid, but json is not expanded on view like other object fields.We can use
fgt.srcipandfgt.sessionidfor search and the search works, but it does not expand the json eitherThe behavior is random, running the query again and again and I get a different display everytime. Sometimes it expands some fields, sometimes others
all fields shown