OpenSearch: How can I use kubernetes.labels.ccv2_cx_sap_com/platform-aspect as a filter?

[geffchang]

Recently, CCV2 Cloud Portal migrated to the new OpenSearch Dashboards. It migrated the filters (or saved search) from the previous logging service. However, the filters don't work anymore.

I tried to use the "Add filter" feature, but I can't filter using "kubernetes.labels.ccv2_cx_sap_com/platform-aspect", since "kubernetes.labels.ccv2_cx_sap_com/platform-aspect" is not indexed in "logs-json-*". How can I filter this field using "Add filter"?

[andyfletcher · Accepted solution]

When you expand the log messages have you got a little yellow warning icon next to the field you are trying to filter on?

You need to do what it says (although it isn't a completely accurate description)

From the burger menu in the top left choose Management > Stack Management

Choose Index Patterns then the `logs-json-*` pattern (should be default)

Click the 'Refresh field list' button in the top right (circular arrow icon)

Your searches should work now, although I've found it's best to re add the filter to get it to apply.

[geffchang · Accepted solution]

Thanks! That worked.