field_coverage
Measure field-level document coverage across an index or datastream, revealing populated, missing, and non-measurable fields to pinpoint normalization problems.
Instructions
Measure what share of the documents actually carries a value per field.
The normalisation-quality measurement, callable without query DSL. For each mapped field it reports the document count and coverage inside a time window and across the whole datastream, because those are different questions:
event.action, wazuh-events-v5-network-activity*
whole datastream (10,238,381 docs) 8.1%
last 24 hours (348,247 docs) 71.0%
last 12 hours 100.0%A decoder fix had landed hours earlier. All three numbers are correct. The window describes the pipeline as it runs now, the datastream describes the stored history — quote the one you mean. When they differ by more than 20 percentage points the diagnostics block says so explicitly, because that gap is the signature of a change in normalisation inside the datastream.
Fields with 0% coverage are listed, never filtered: mapped-but-never-
populated is the agent.id trap and the most important result this
measurement produces.
Coverage is three-valued — populated, not populated, not measurable. An exists aggregation returns 0 for a field the mapping declares "index": false no matter what the documents hold, so the mapping is read first and such fields are reported as not measurable, with dashes, never as 0%. Verified: event.original in wazuh-events-v5-network-activity* is index:false and doc_values:false, matches 0 of 10,243,389 documents, and carries the complete raw log line in _source of every document sampled. For those fields the tool samples _source and reports in how many of the sampled documents the key is present — evidence rather than a coverage figure.
Cost scales with the field count — the schema has 2351 fields — so the
listing is capped at KLAXON_SCHEMA_FIELD_LIMIT (default 200) and the cap is
reported. Pass a prefix to measure a namespace instead of a truncation.
Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". prefix: Restrict to a field namespace, e.g. "source." or "wazuh.". hours: Size of the time window ending now, in hours. Default 24. min_docs: Hide fields below this document count in the window. Default 0, which hides nothing. Any higher value removes the 0% fields — the ones worth looking at — so the output says how many it dropped.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| index | Yes | ||
| prefix | No | ||
| min_docs | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |