# How to handle unmapped fields

**URL:** <https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991>\
**Category:** Kibana\
**Created:** [October 29, 2023, 8:43pm UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991 "2023-10-29T20:43:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hta](https://avatars.discourse-cdn.com/v4/letter/h/a8b319/32.png) [@hta](https://discuss.elastic.co/u/hta)\
**Post date:** [October 29, 2023, 8:43pm UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/1 "2023-10-29T20:43:17Z")

</div>

```auto
filter {
  grok {
    id => "name school grok filter"
    match => { 'message' => '^.*name=\'%{WORD:student.name}\'.*school=\'%{WORD:student.school}\''}
  }
}

```

For example, with WORD:student.name I would like to create a field "student" and this field contains the information such as name. In Kibana "discover" I can see the logs, but it shows me that "student.name" is not mapped (Unmapped fields). How do I get that? I described the field under Index Management -\> Index Templates -\> Settings (from template). Still it doesn't work...

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 30, 2023, 4:50am UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/2 "2023-10-30T04:50:39Z")

</div>

If you want nested fields/multi-fields:

`%{WORD:[student][name]}`  
`%{WORD:[student][school]}`

You will get:

```auto
"student": { 
   "name": "some name",
   "school": "school"
}

```

---

<div class="post-metadata">

**Author:** ![hta](https://avatars.discourse-cdn.com/v4/letter/h/a8b319/32.png) [@hta](https://discuss.elastic.co/u/hta)\
**Post date:** [October 30, 2023, 8:26am UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/3 "2023-10-30T08:26:15Z")

</div>

I tried that, unfortunately I get the same result. What else could I try?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 30, 2023, 2:23pm UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/4 "2023-10-30T14:23:28Z")

</div>

You cannot mix a string/text and a JSON object.  
The "student.name" is the text .[student][name] is a nested/JSON field.  
Go to Kibana and check Data view, if is text/keyword, delete index or reindex or make a new and recreate the data view.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 30, 2023, 2:35pm UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/5 "2023-10-30T14:35:14Z")

</div>

> [@hta](#):
>
> I described the field under Index Management -\> Index Templates -\> Settings (from template).

Please, share what you did here.

Did you create a template with the mapping for those fields?

If so, did you recreate the indice? Templates are only applied on index creation.

Also, in Logstash `student.name` is different from `[student][name]`, the first is a field with a dot and the name and the second is a json object.

The first is this:

```auto
{ "student.name": "name" }

```

And the second is this:

```auto
{ "student": { "name": "some name" } }

```

You need to create a mapping for the `student` field as a json object, and add a nested field for the `name` field with the correct mapping.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2023, 2:35pm UTC](https://discuss.elastic.co/t/how-to-handle-unmapped-fields/345991/6 "2023-11-27T14:35:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.