索引仅显示前3个字段，如何在创建索引的下拉菜单中添加指定字段？

Hey there! Let's walk through how to get those missing fields (From, Subject, To_Recipients, body) into your index's dropdown menu and resolve the issue where only the first 3 fields show up. Here's the step-by-step breakdown:

1. First, Verify the Fields Exist in Your Index #

Before anything else, you need to confirm if the fields you want are actually present in your index:

• If you're using Elasticsearch, run this command to check the index mapping:

  GET /your_target_index/_mapping
  

  Look for entries for From, Subject, To_Recipients, and body in the response. If they're missing, you'll need to add them first (more on that later).
• For other tools (like Splunk, Tableau, or custom indexing systems), check your data source connection settings to ensure these fields aren't being filtered out during ingestion.

2. Make Fields Visible in the Dropdown Menu #

Once you confirm the fields exist, you need to enable them for display in the dropdown:

For Kibana Users: #

• Go to Stack Management > Index Patterns
• Find your target index pattern and click Edit pattern
• Scroll to the Fields section. For each field you want to add, make sure the Searchable and Displayable checkboxes are ticked. Save the changes, and the fields will appear in your dropdown.

For Other Platforms: #

• Check your tool's index configuration settings. Look for options like "Visible Fields", "Allowed Fields", or "Dropdown Field List" and add your desired fields to this list. Save the configuration and refresh the interface.

3. Fix the "Only 3 Fields Display" Issue #

This is almost always a default display limit setting:

• In Kibana's Discover tab: Click the Fields panel, then select Manage fields. Here you can adjust the number of visible fields, or set your preferred fields as "default" so they always show up.
• For other tools: Look for settings like "Default Display Fields" or "Field Limit" in the index or visualization configuration. Increase the limit or explicitly list the fields you want to display.

4. Add Missing Fields to the Index (If They Don't Exist) #

If the fields aren't present in your index at all:

Elasticsearch Example: #

• First, update the index mapping to define the new fields:

  PUT /your_target_index/_mapping
  {
    "properties": {
      "From": {"type": "text"},
      "Subject": {"type": "text"},
      "To_Recipients": {"type": "text"},
      "body": {"type": "text"}
    }
  }
  

• Re-ingest your data (or run a reindex job) so the new fields are populated. After this, you can follow step 2 to make them visible in the dropdown.

Other Tools: #

• Adjust your data ingestion pipeline to include these fields, then reprocess or reimport your data. Once the fields are in the index, configure their visibility as outlined earlier.

A quick note: Always double-check that your data actually includes these fields before troubleshooting—sometimes the issue is that the source data doesn't have them to begin with!

内容的提问来源于stack exchange，提问作者kuhi