Kibana 4：如何可视化嵌套对象

Question

我有一个嵌套对象如下

{"stats": {"abc": {"NumSources": 6, "Size": 12754890006, "Sources": {"NodeA": {"NumFiles": 246, "Size": 509071269}, "NodeB": {"NumFiles": 104, "Size": 823385346}, "NodeC": {"NumFiles": 466, "Size": 1259819487}, "NodeD": {"NumFiles": 178, "Size": 1712383515}, "NodeE-daemon": {"NumFiles": 79, "Size": 7338}, "NodeF": {"NumFiles": 244, "Size": 8450223051}}}}}

这是我创建的映射

put statsview
{
  "mappings":{
    "test2":{

      "properties":{
          "stats":{
            "type":"nested",
            "properties":{
              "abc":{
                "type":"nested",
                "include_in_parent": true,
                "properties": {
                  "NumSources": {
                    "type": "long"
                  },
                  "Size": {
                    "type": "long"
                  },
                  "Sources": {
                    "type":"nested",
                    "include_in_parent": true,
                    "properties": {
                      "NodeA": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      },
                      "NodeB": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      },
                      "NodeC": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      },
                      "NodeD": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      },
                      "NodeE": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      },
                      "NodeF": {
                        "type":"nested",
                        "include_in_parent": true,
                        "properties": {
                          "NumFiles": {
                            "type": "long"
                          },
                          "Size": {
                            "type": "long"
                          }
                        }
                      }
                    }
                  }
                }
            }
          }
        }
      }
    }
  }
}

请注意，在每个级别，我都包含规范"include_in_parent": true,

现在，在我的Kibana Discover视图中，我只看到一条记录，这是有道理的。

GET statsview/_search { "query": { "match_all": {} } }

给了我

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 1,
    "hits": [
      {
        "_index": "statsview",
        "_type": "test2",
        "_id": "1",
        "_score": 1,
        "_source": {
          "logs": {
            "abc": {
              "NumSources": 6,
              "Size": 12754890006,
              "Sources": {
                "NodeA": {
                  "NumFiles": 246,
                  "Size": 509071269
                },
                "NodeB": {
                  "NumFiles": 104,
                  "Size": 823385346
                },
                "NodeC": {
                  "NumFiles": 466,
                  "Size": 1259819487
                },
                "NodeD": {
                  "NumFiles": 178,
                  "Size": 1712383515
                },
                "NodeE-daemon": {
                  "NumFiles": 79,
                  "Size": 7338
                },
                "NodeF": {
                  "NumFiles": 244,
                  "Size": 8450223051
                }
              }
            }
          }
        }
      }
    ]
  }
}

所以我在Kibana的Discover视图中看到了这个记录。但我无法运行像

这样的查询

logs.abc.Sources

所以我希望看到所有的源，即NodeA到NodeF。我甚至试过

logs.abc.Sources:[NodeA To NodeF]

但我仍然获得状态200。

1. Kibana是否支持对嵌套对象运行此类查询？
2. 如何可视化这些嵌套对象？
3. 我的地图是否正确？