Data view field conflicts resolving by filtering data #187860
Labels
enhancement
New value added to drive a business result
Team:DataDiscovery
Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.
**Kibana version: 8.14.0 **
Describe the bug:
I know that field conflicts are an issue and the data view is telling me about it. I like to use the generic data views such as logs-* which enable this problem.
What I would expect is if I have to data streams:
where one maps the
source.ip
asip
and one maps it askeyword
. That the data view:demo-kibana.*
shows a conflict. That is working as expected.Now when I add a KQL and filter down using constant keyword:
demo-kibana.log
I would expect the conflict to go away and for Kibana to let me use the field. Because within the same dataset the field is mapped the same. There is no conflict within demo-kibana.log there is a conflict betweenkibana.log
andkibana.audit
The issue is that this also forbids me to use in controls since the data view “errors”.
I would expect Kibana to reevaluate the fields once I add a KQL that filters me away entire shards that create this issue, such as using constant keyword for data_stream.dataset.
Steps to reproduce:
Expected behavior:
When filtering down to a subset the fields shold be re-evaluated. Making sure that there are only conflicts within the actual queried indices.
Screenshots (if relevant):
The text was updated successfully, but these errors were encountered: