Can't create new field

Hi Kibaners!

Elastic + Kibana + Filebeat 5.6.6. We've an index (filebeat-*) with 4.000.000 of log lines.
We've created a new JSON field in our logs "POE" and used it in most recents logs, 13/03/2018.

It shows an advice in Disover section

Yes, I go to Management > Index Pattern > filebeat.* and "Refresh Field List"

But..., there's no update and the field POE is not shown...

When your new documents got indexed, your index mappings still had

"_default_": {
  "dynamic": "false",

so when you started indexing docs with POE in them, they wouldn't have updated the index mappings. I think that's your problem.

Oh... Yes... We've changed it four months ago and don't remember now. If we change "dynamic": "true", and load new data with POE field it will works?


I am not able to change the value of "dynamic" with

PUT _template/filebeat*-
  "template": "*",
  "settings": {
    "index.mapper.dynamic": true

And other codes I've tried... can you help me pls?


Solved. After doing that and change the templates using cerebro we must to delete the index with the new field and reload it.

Thanks :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.