Can't create new field

[davidsoler95 (David Soler Balado)]

Hi Kibaners!

Elastic + Kibana + Filebeat 5.6.6. We've an index (filebeat-*) with 4.000.000 of log lines.
We've created a new JSON field in our logs "POE" and used it in most recents logs, 13/03/2018.

It shows an advice in Disover section

Yes, I go to Management > Index Pattern > filebeat.* and "Refresh Field List"

But..., there's no update and the field POE is not shown...
Mapping: https://pastebin.com/hnMh5H2z

[a5a (Archana)]

When your new documents got indexed, your index mappings still had

"_default_": {
  "dynamic": "false",

so when you started indexing docs with POE in them, they wouldn't have updated the index mappings. I think that's your problem.

[davidsoler95 (David Soler Balado)]

Oh... Yes... We've changed it four months ago and don't remember now. If we change "dynamic": "true", and load new data with POE field it will works?

[davidsoler95 (David Soler Balado)]

Hi...

I am not able to change the value of "dynamic" with

PUT _template/filebeat*-
{
  "template": "*",
  "order":0,
  "settings": {
    "index.mapper.dynamic": true
  }
}

And other codes I've tried... can you help me pls?

Thanks

[davidsoler95 (David Soler Balado)]

Solved. After doing that and change the templates using cerebro we must to delete the index with the new field and reload it.

Thanks