# Filebeat's default index mapping causes Kibana to display many empty date fields

**URL:** https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324
**Category:** Beats
**Tags:** filebeat
**Created:** [June 23, 2020, 6:55pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324 "2020-06-23T18:55:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![temp4746](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/temp4746/32/45812_2.png) [@temp4746](https://discuss.elastic.co/u/temp4746)
#### Post date: [June 23, 2020, 6:55pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324/1 "2020-06-23T18:55:16Z")

</div>

I tried a default dev setup of the ELK stack with Filebeat reading from some Docker container outputting Elastic Common Schema JSON. It looks like the default index mapping that Filebeat sets up causes Kibana to show many date fields in the fields pane and when expanding documents. Those values are not sent by the container and have no value in any document, it looks like those are only the fields that are of the date type, fields like `azure.enqueued_time`, `cef.extensions.startTime`.

Is there any way to prevent Kibana from showing this, it makes it very difficult to use having many such fields showing, and having to define a custom index mapping due to this rather then use the default one doesn't feel right.

Screenshot:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/859ec10e9a250ba4f3e62550f23e96ef75a36eb5.png)

The Filebeat input:

```
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      hints.default_config.enabled: false

```

With this container labels:

```
  co.elastic.logs/enabled: 'true'
  co.elastic.logs/json.keys_under_root: 'true'
  co.elastic.logs/json.add_error_key: 'true'
  co.elastic.logs/json.message_key: message
```

---

<div class="post-metadata">

### Author: ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)
#### Post date: [June 23, 2020, 8:19pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324/2 "2020-06-23T20:19:25Z")

</div>

> <https://github.com/elastic/kibana/issues/69545>
>
> Kibana version: 7.8 - master
> Elasticsearch version: 7.8 - master
> Original install method (e.g. download page, yum, from source, etc.): source
> Describe the bug:
> If...

---

<div class="post-metadata">

### Author: ![temp4746](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/temp4746/32/45812_2.png) [@temp4746](https://discuss.elastic.co/u/temp4746)
#### Post date: [June 23, 2020, 8:42pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324/3 "2020-06-23T20:42:32Z")

</div>

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2020, 10:42pm UTC](https://discuss.elastic.co/t/filebeats-default-index-mapping-causes-kibana-to-display-many-empty-date-fields/238324/4 "2020-07-21T22:42:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.