# Can't create new field

**URL:** <https://discuss.elastic.co/t/cant-create-new-field/123776>\
**Category:** Kibana\
**Created:** [March 13, 2018, 4:30pm UTC](https://discuss.elastic.co/t/cant-create-new-field/123776 "2018-03-13T16:30:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\
**Post date:** [March 13, 2018, 4:30pm UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/1 "2018-03-13T16:30:46Z")

</div>

Hi Kibaners!

Elastic + Kibana + Filebeat 5.6.6. We've an index (filebeat-\*) with 4.000.000 of log lines.  
We've created a new JSON field in our logs "POE" and used it in most recents logs, 13/03/2018.

It shows an advice in Disover section

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a5f7e24d25cff0ae1dc609f587c21345b7fee30.png)

Yes, I go to Management \> Index Pattern \> filebeat.\* and "Refresh Field List"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9b42c31cc21af9b5f9d0458ebd99efbf7c1be983.png)

But..., there's no update and the **field POE** is not shown...  
Mapping: [https://pastebin.com/hnMh5H2z](https://pastebin.com/hnMh5H2z)

---

<div class="post-metadata">

**Author:** ![a5a](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@a5a](https://discuss.elastic.co/u/a5a)\
**Post date:** [March 14, 2018, 2:07am UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/2 "2018-03-14T02:07:30Z")

</div>

When your new documents got indexed, your index mappings still had

```json
"_default_": {
  "dynamic": "false",

```

so when you started indexing docs with `POE` in them, they wouldn't have updated the index mappings. I think that's your problem.

---

<div class="post-metadata">

**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\
**Post date:** [March 14, 2018, 8:54am UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/3 "2018-03-14T08:54:35Z")

</div>

Oh... Yes... We've changed it four months ago and don't remember now. If we change `"dynamic": "true",` and load new data with POE field it will works?

---

<div class="post-metadata">

**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\
**Post date:** [March 14, 2018, 4:15pm UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/4 "2018-03-14T16:15:23Z")

</div>

Hi...

I am not able to change the value of `"dynamic"` with

```
PUT _template/filebeat*-
{
  "template": "*",
  "order":0,
  "settings": {
    "index.mapper.dynamic": true
  }
}

```

And other codes I've tried... can you help me pls?

Thanks

---

<div class="post-metadata">

**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\
**Post date:** [March 15, 2018, 9:00am UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/5 "2018-03-15T09:00:43Z")

</div>

Solved. After doing that and change the templates using [cerebro](https://github.com/lmenezes/cerebro) we must to delete the index with the new field and reload it.

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2018, 9:00am UTC](https://discuss.elastic.co/t/cant-create-new-field/123776/6 "2018-04-12T09:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.