# Index mapping shows key as "object", Kibana Management as "string"

**URL:** https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595
**Category:** Kibana
**Created:** [August 3, 2020, 2:53pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595 "2020-08-03T14:53:03Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [August 3, 2020, 2:53pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/1 "2020-08-03T14:53:03Z")

</div>

Hello all,

I'm trying to understand why `Kibana > Management > Index Patterns` shows me one thing and using Dev Tools to query API shows me another.

Some of our logs have the key `json.user_agent`.

In `Kibana > Management > Index Patterns` I see the following (I have tried _refreshing_ many times)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1bcc446f3a7490e7eb7aa484b295deb4df78282.png)

In the console when I look at the key it says

```
GET _mapping/field/json.user_agent
{
  "index-name" : {
    "mappings" : { }
  },
....
}

```

or alternatively

```
GET /index-name/_mapping
            "user_agent" : {
              "type" : "object"
            },

```

So, looks like the true _type_ is `object` but Kibana thinks it is `string` for some reason.

There is no template that sets the _type_ for this key.

ES and Kibana version 7.8.1, both upgraded recently from older versions.

The same is true in version 7.8.0 as well in environments where I have not yet upgraded to the latest version.

Any tips on how to reconcile this?

Cheers,  
AB

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [August 4, 2020, 5:47pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/2 "2020-08-04T17:47:55Z")

</div>

Hello @A_B

Are you able to share the full results of these queries? I suspect there might be confusion over field names but I can't determine that from partial information.

Thanks,  
Matt

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [August 5, 2020, 1:15pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/3 "2020-08-05T13:15:37Z")

</div>

Hi @mattkime,

thank you for the reply 🙂

We have historically had significant problems with _data type collisions_ for keys because we do not have any internal common schema for logs 😕

Usually Kibana would notice this and report the field as having a conflict between indices matching the _index pattern_.

We use fairly broad _index patterns_ in Kibana. My following example will show 6 matches for `index_name_prefix` per date

```
$ for i in $(curl -s http://elasticsearch:9200/_cat/indices | grep index_name_prefix | grep 2020.07.27 | cut -d ' ' -f 3); do curl -s http://elasticsearch:9200/$i/_mapping | jq '.["'${i}'"].mappings.properties.json.properties.user_agent' ; done
null
null
null
null
{
  "type": "text",
  "fields": {
    "keyword": {
      "type": "keyword",
      "ignore_above": 256
    }
  }
}
null
$ for i in $(curl -s http://elasticsearch:9200/_cat/indices | grep index_name_prefix | grep 2020.08.05 | cut -d ' ' -f 3); do curl -s http://elasticsearch:9200/$i/_mapping | jq '.["'${i}'"].mappings.properties.json.properties.user_agent' ; done
null
null
null
null
{
  "type": "object"
}
null

```

As you can see, the data _type_ is not the same in those two instances where this key exists. So I guess, what was unexpected was that Kibana did not report this key as having data type conflicts.

As I suspected, the root cause will be our poor log schema, I was just confused by the reporting in Kibana.

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [August 5, 2020, 2:46pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/4 "2020-08-05T14:46:40Z")

</div>

I'm don't yet have a specific answer and agree that the reporting is a bit confusing. That said, it sounds like the schema is likely the problem.

Have you looked at ECS? [https://www.elastic.co/guide/en/ecs/current/ecs-reference.html](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html)

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [August 5, 2020, 3:05pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/5 "2020-08-05T15:05:49Z")

</div>

I did not submit the full mapping as it have a lot of keys (1000+). The mapping in question is not ECS compatible. `json.user_agent` is a pre-ECS convention we have used. We are working on adapting ECS which uses `user_agent.*`

That still does not change the fact that Kibana does not tell me that there is a conflict in data type for the specific key between the indices matching the index pattern I have configured, which is what confused me while troubleshooting some issues.

This thread can be closed 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2020, 3:05pm UTC](https://discuss.elastic.co/t/index-mapping-shows-key-as-object-kibana-management-as-string/243595/6 "2020-09-02T15:05:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
