# All fields have the status "unknown field" **URL:** \ **Category:** Kibana\ **Created:** [December 10, 2024, 1:28pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760 "2024-12-10T13:28:25Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 10, 2024, 1:28pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/1 "2024-12-10T13:28:25Z")
Hello, We have a problem, all fields have the status "unknown field" on our Kibana, wich breaks most of our searches.. Do you know how to solve this ? Regards, ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e6ecb87c8e54463dc893cf98e5c380fd74e1f33.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 10, 2024, 3:56pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/2 "2024-12-10T15:56:47Z")
Hi @atbc What version of Kibana... and Elasticsearch Sometimes, the Data View Cache does not get updated on older versions ... Can you try Shift Reload or Clear Kibana Browser Cache and re-login or Try on New Incognito Window? Also go check the Data View and make sure it is there and looks correct ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 10, 2024, 4:12pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/3 "2024-12-10T16:12:27Z")
Hi Steph, Elasticsearch and Kibana are in version 8.14.1 I tried it in incognito mode, and it was the same. I have the impression that this happened the day our cluster (3 nodes) exceeded 3000 shards, I don't know if this can give you any help? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 10, 2024, 4:19pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/4 "2024-12-10T16:19:40Z")
> [@atbc](#): > > I have the impression that this happened the day our cluster (3 nodes) exceeded 3000 shards, I don't know if this can give you any help? hmmm... Have you recovered from that? Did you adjust settings? Is your cluster healthy / green? If not, that could be a problem... Are you getting errors in Discover? Does the Field List on the Right side of Discover look the same? ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 10, 2024, 4:41pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/5 "2024-12-10T16:41:56Z")
Yes, our cluster is healthy and we have adjusted the parameters to prevent this from happening again. ![Capture d’écran 2024-12-10 173226](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6bfabc1292670fbb7d902954a6e8b645b279109.png) On the other hand, we have a problem in the “Discover” section. If we search for data in a data view we've created (for example, “Juniper” here), there's no problem : ![Capture d’écran 2024-12-10 173414](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e9301ae1d954d667e9762e2eecda3ff3f677656.png) But, in the default data view, for example logs-\*, we have the “unknown field” problem : ![Capture d’écran 2024-12-10 173629](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d005da8493801550294b65a999ba5d284f9e64a.png) ![Capture d’écran 2024-12-10 174236](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f82973d1f977ffb43f46701f950aba348fb61b16.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 10, 2024, 4:50pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/6 "2024-12-10T16:50:42Z")
Hmmm not sure.. Is that juniper basically just another logs-\* dataview? Go look at the `logs-*` dataview does it look correct? Can you perhaps update it? (careful could be connected to Dashboards etc, that is why I might just try to add another index... then remove etc... not delete the whole Data View and re-create it.) Seems like it might be corrupt... you might need to recreate it. Create a New Space and New logs-\* data view do you see the same? ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 11, 2024, 3:28pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/7 "2024-12-11T15:28:45Z")
We've created a new space, but we have the same problem in the “discover” section: when we want to create a new “data view”, we can't select a “Timestamp field” because it can't find one. ![Capture d’écran 2024-12-11 162158](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56924704b4873ad6600f01165f37b5b98457f303.png) And yes, “Juniper” is a Data View created from logs-\* ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 11, 2024, 3:33pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/8 "2024-12-11T15:33:02Z")
Hmmm never seen that before ... So you are saying if you name the dataview `foo` it works But if you name it `logs` it does not? Try making the index pattern specific to an index and see if it picks up a timestamp... If not check the actually mapping of that specific index... Agree something odd ... not sure I have an easy answer. Also sometimes when you get a new space... the `logs-*` comes for free perhaps delete it and try to re-create ... in the new space ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 13, 2024, 11:00am UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/9 "2024-12-13T11:00:31Z")
Hello, Yes, if we name a data view "foo" it works, but not the default logs-\* view. We tried to create a new space named "Test" and we have the same problem with logs-\* ![Capture d’écran 2024-12-13 115006](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00cea62ceb2d11df9de3d36d08ec15eb5894f2b7.png) There is no field in the data view logs-\*, is it possible to reinstall this part? ![Capture d’écran 2024-12-13 115927](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5f5ed9fa59c152b8a11bb44287bf3928dee5a2b.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 13, 2024, 2:27pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/10 "2024-12-13T14:27:20Z")
Definitely weird and I have not seen that before. Let me check one more thing and get back. I'll check some internal. Notes But You can delete the `logs-*` data view and simply recreate it p That is always an option Or you could try to just simply rename or edit the existing logs-\* and see if that fixes it. On the version you're on, data views are dynamically created so there's no real static data unless you've added runtime fields or something like that. ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 13, 2024, 2:46pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/11 "2024-12-13T14:46:54Z")
We tried to delete it to recreate it but it was impossible to recreate it because it could not find the "Timestamp field" ![Capture d’écran 2024-12-13 154352](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e02b9ff4ffdf2e86026a6637c486c9fca085ac43.png) Could a Kibana or Elasticsearch update automatically reinstall it ? Thank you for your research ! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 13, 2024, 2:56pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/12 "2024-12-13T14:56:33Z")
I'm going to look into some of our knowledge bases. Let me get back to You. Tried deleting all the logs-\* ... It is shared across data views so you might need to look and make sure it's cleaned up everywhere. You could Go to integration integrations And find custom logs and add assets or reinstall. See if that works I'll go take a look but this is very unusual. I have not personally heard of this / encountered before. You could also try rebooting kibana ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 13, 2024, 3:54pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/13 "2024-12-13T15:54:10Z")
Can you go to Kibana - Dev Tools > **[Delete a data view | Kibana API (v8)](https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-deletedataviewdefault)** > > The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects. > The API calls are stateless. > Each request that you mak... `GET kbn:/api/data_views` Make sure there is not some leftover dataview with that name If So delete it `DELETE kbn:/api/data_views/data_view/logs-*` Then re-create ```auto POST kbn:/api/data_views/data_view { "data_view": { "id": "logs-*", "namespaces": [ "*", "default" ], "title": "logs-*" } } ``` ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 17, 2024, 8:29am UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/14 "2024-12-17T08:29:14Z")
Hello, The "logs-\*" dataview was deleted and I added it with the command you gave me I found the "logs-\*" dataview in stack management, but there's no field for it, as shown in the screenshot below : ![Capture d’écran 2024-12-17 092713](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba04a242f7d7bdf288d1ddcf7bec05afea29b442.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2024, 2:34pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/15 "2024-12-17T14:34:24Z")
I have no clue what's going on.. Assuming you're locked in as a super user or the elastic user, correct? Are there any other health warnings on your cluster? ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [December 17, 2024, 3:04pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/16 "2024-12-17T15:04:10Z")
This command returns a code 400 as shown in the screenshot below : ![Capture d’écran 2024-12-17 155359](https://us1.discourse-cdn.com/elastic/original/3X/1/8/1829289f062bda5ea223c1a61b923f195522429b.png) Yes I am connected with the user "elastic" and we have no other significant alerts on the cluster Strange case ... ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2024, 3:11pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/17 "2024-12-17T15:11:21Z")
Apologies I messed up that command ... OK try this... ```auto POST kbn:/api/data_views/data_view { "data_view": { "id": "temp-dataview", "namespaces": [ "default" ], "title": "logs-*", "name": "temp", "timeFieldName" : "@timestamp" } } ``` And on the right side you should get something like this ...long ```auto { "data_view": { "id": "temp-dataview", "version": "WzE2MjMwLDYzXQ==", "title": "logs-*", "timeFieldName": "@timestamp", "sourceFilters": [], "fieldFormats": {}, "runtimeFieldMap": {}, "fieldAttrs": {}, "allowNoIndex": false, "name": "temp", "allowHidden": false, "fields": { "@timestamp": { "count": 0, "name": "@timestamp", "type": "date", "esTypes": [ "date" ], ...... much more ``` Go try that in Discover... and report back ---
**Author:** ![atbc](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@atbc](https://discuss.elastic.co/u/atbc)\ **Post date:** [February 4, 2025, 3:17pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760/18 "2025-02-04T15:17:40Z")
Hello, I'd like to give you some feedback because we managed to solve the problem...by updating the stack Regards,