# Fields parsed by Grok show up as unknown type

**URL:** <https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254>\
**Category:** Logstash\
**Created:** [November 16, 2016, 1:57pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254 "2016-11-16T13:57:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![adrianp](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@adrianp](https://discuss.elastic.co/u/adrianp)\
**Post date:** [November 16, 2016, 1:57pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/1 "2016-11-16T13:57:05Z")

</div>

So my fields are being parsed and I see them in Kibana when I run queries, but all my parsed fields are listed as "unknown" for their data types. Also, if I try to create a visualization, it's not listing any of my parsed fields, only the text message fields which is how the Apache log came in. I'm fairly new to ELK, so I'm still trying to figure things out using the current version (5.0) I have Filebeat processing Apache logs and sending them to Logstash for processing.

---

<div class="post-metadata">

**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\
**Post date:** [November 16, 2016, 2:23pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/2 "2016-11-16T14:23:27Z")

</div>

you need to refresh your index

go to Kibana-\>settings-\>indecies-\> the index name you will see a table of "Known" fields and there will be a fresh button on top. Hit that and you will see the "Count" of fields go up and you should be able to find your new fields in that table now.

---

<div class="post-metadata">

**Author:** ![adrianp](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@adrianp](https://discuss.elastic.co/u/adrianp)\
**Post date:** [November 16, 2016, 2:34pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/3 "2016-11-16T14:34:55Z")

</div>

That worked! Thank you so much!

Adrian

---

<div class="post-metadata">

**Author:** ![adrianp](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@adrianp](https://discuss.elastic.co/u/adrianp)\
**Post date:** [November 16, 2016, 3:15pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/4 "2016-11-16T15:15:09Z")

</div>

Follow up question, is there a way for me to specific the data type for specific fields? For example, I noticed that the IP fields got classified as text.

---

<div class="post-metadata">

**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\
**Post date:** [November 16, 2016, 5:07pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/5 "2016-11-16T17:07:09Z")

</div>

that is a bit more complex

Check this out  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html)

but I am weaker on this subject which I would open a seperate thread , and provide your current mapping and example document (JSON from Elastic) . That would be the info they would need for others to help you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2016, 5:07pm UTC](https://discuss.elastic.co/t/fields-parsed-by-grok-show-up-as-unknown-type/66254/6 "2016-12-14T17:07:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.