How to filter "unknown" fields


#1

I use ELK 5.0.1 + Filebeat 5.0.1.

I configure Filebeat to send json logs to Elasticsearch.
When I visualize the logs in Kibana, I have a lot of "unknown" field.
I want to filter some of this field like I can do with the "message" field.

How can I do this ?

http://img4.hostingpics.net/pics/696715unknownfields.png


(Spencer Alger) #2

You probably need to refresh Kibana's mapping cache. This doc page describes the process a bit


#3

That solve my issue.
Thanks.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.