Why a field appears in Kibana but cannot be searched

A field visible in a document is not necessarily searchable or aggregatable. Kibana may display a value from _source even when Elasticsearch has no searchable representation of that value. Start with the mapping and field capabilities, then inspect the actual documents.

Inspect the affected indices

In Kibana Dev Tools:

GET your-index/_mapping
GET your-index/_field_caps?fields=target_field,target_field.*
GET your-index/_search
{
  "size": 1,
  "query": { "match_all": {} }
}

Use the same index pattern and time interval as the failing view. A data view spanning several indices can encounter conflicting types or different capabilities for the same field.

• A text field supports analyzed full-text search; a keyword field supports exact values and is normally suitable for aggregation.
• index: false disables the inverted index, but does not always make a field unsearchable. Certain types, including keyword, numeric, date, boolean, IP, and geo-point fields, can still be queried through doc values, usually more slowly.
• An object with enabled: false is not parsed into searchable subfields.
• Fields ignored under dynamic: false can remain in _source without a mapping.

Match the query to the field

For a text field, use an analyzed match query when searching words. For an exact value or an aggregation, use the actual keyword field or multi-field defined in the mapping. A .keyword suffix is common, but it is not guaranteed to exist.

ignore_above can also explain missing matches: keyword values exceeding the configured character limit are skipped for indexing and doc values while remaining in _source. An array can therefore contain some searchable elements and some ignored ones.

Refresh the view only after checking the data

Data view field metadata can be cached. Refresh the field list where your Kibana version provides that control, or reload the data view. Interface details vary by version. Refreshing cannot create an absent field, fix a rejected document, or change an Elasticsearch mapping.

If the field never reaches Elasticsearch, inspect the collector and Logstash output errors. If its stored type is unsuitable, create a correctly mapped index, reindex the data, and switch the alias. Adding a keyword multi-field still requires existing documents to be reprocessed before it contains values.

A successful fix means the intended values are present, searchable using the right query, and consistently mapped across the indices your data view covers.

References: the index mapping parameter and ignore_above.