# How to associate Grok fields with Elasticsearch/Kibana "Available Fields"?

**URL:** <https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458>\
**Category:** Elasticsearch\
**Created:** [June 30, 2016, 6:00pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458 "2016-06-30T18:00:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [June 30, 2016, 6:00pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/1 "2016-06-30T18:00:26Z")

</div>

I was able to Grok my logs to produce this example line in my logstash.json file. Here's my Grok filter

```
 grok {
    match => {
      "message" => "%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}:%{DATA:thread}%{SPACE}:%{SPACE}%{NUMBER:thread_pool}%{SPACE}\[(?<classname>[^\]]+)\]%{SPACE}%{GREEDYDATA:msgbody}"
    }
}

```

`{"@timestamp":"2016-04-22T20:43:25.172Z","message":"2016-04-22 16:43:25,172 ERROR :WebContainer : 2 [com.mycomapany.SomeClass] My log message.","@version":"1","path":"/home/some_path/trm-error.log","host":"myHost","logdate":"2016-04-22 16:43:25,172","loglevel":"ERROR","thread":"WebContainer","thread_pool":"2","classname":"com.mycompany.SomeClass","msgbody":"My log message."}`

So how do I feed my json file into Elasticsearch so I'm able to see the following fields (from my Grok filter) in the "Available Fields" panel in Kibana? Make sense?

- logdate
- loglevel
- thread
- thread\_pool
- classname
- msgbody

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 30, 2016, 6:20pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/2 "2016-06-30T18:20:20Z")

</div>

Just add an elasticsearch output in your Logstash configuration to send the events to your ES instance.

---

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [June 30, 2016, 6:22pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/3 "2016-06-30T18:22:47Z")

</div>

Yes, I have this already. I DO see the logs in Kibana, I jost don't see the fields in "Available Fields" panel.

```
output {
  file {
    path => "/home/some_path/trm-logstash.json"
  }
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}
```

---

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [June 30, 2016, 6:55pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/4 "2016-06-30T18:55:35Z")

</div>

Kibana are flagging those as "missing fields?" What does that mean? IOW, if I uncheck the "Hide Missing Fields" checkbox, I do see the fields, but are greyed out.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 30, 2016, 7:16pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/5 "2016-06-30T19:16:22Z")

</div>

> I DO see the logs in Kibana, I jost don't see the fields in "Available Fields" panel.

Have you [reloaded the index fields list](https://www.elastic.co/guide/en/kibana/current/settings.html#reload-fields)?

---

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [June 30, 2016, 8:00pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/6 "2016-06-30T20:00:10Z")

</div>

When I go to Settings -\> indices tab -\> select logstash-\*, I do see the fields I want there. I went ahead and did a reload anyway as you suggested. Now when i go to the Discover tab, I see the logstash-\* index, and in it's Available Fields, the fields that I want are designated as "Missing Fields," that is, I only see them if I uncheck the "Hide Missing Fields" check box.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:39pm UTC](https://discuss.elastic.co/t/how-to-associate-grok-fields-with-elasticsearch-kibana-available-fields/54458/7 "2017-07-05T22:39:09Z")

</div>