How to filter "unknown" fields

I use ELK 5.0.1 + Filebeat 5.0.1.

I configure Filebeat to send json logs to Elasticsearch.
When I visualize the logs in Kibana, I have a lot of "unknown" field.
I want to filter some of this field like I can do with the "message" field.

How can I do this ?

You probably need to refresh Kibana's mapping cache. This doc page describes the process a bit


That solve my issue.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.