Advanced feature: indexPattern:fieldMapping:lookBack

[rcowart (Rob Cowart)]

Reading the description for indexPattern:fieldMapping:lookBack:

For index patterns containing timestamps in their names, look for this many recent matching patterns from which to query the field mapping

I would expect that when setting up or refreshing an Index Pattern in Kibana, it would only consider the mapping of the last 5 indices. However that is not what is happening. It is definitely looking back at mappings of older indices as well.

Unfortunately this setting is not covered in the docs (Advanced Settings | Kibana Guide [8.11] | Elastic), so I can't confirm how this is supposed to work.

Does anyone have any insights on the expected behavior of this setting?

[christophilus (Chris Davies)]

Hi Robert, the default value for this setting is 5, so I think your assumptions are correct. This may be a bug, but it could also be that your indices have incorrectly formatted timestamps in their names.

If you think it's a bug, you can log it here: https://github.com/elastic/kibana/issues

Please provide more info, if you do log a bug:

• A list of your index names (at least going back as far as the index whose mappings are incorrectly showing up)
• Mappings from the old index (that shouldn't be showing up)
• Some of the mappings from the more recent indices (that should be showing up)
• The version of Kibana you're running

Thanks!