# Issue in mapping of fileds

**URL:** <https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816>\
**Category:** Kibana\
**Created:** [June 26, 2020, 8:50am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816 "2020-06-26T08:50:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![muhammad.ashraf](https://avatars.discourse-cdn.com/v4/letter/m/96bed5/32.png) [@muhammad.ashraf](https://discuss.elastic.co/u/muhammad.ashraf)\
**Post date:** [June 26, 2020, 8:50am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816/1 "2020-06-26T08:50:47Z")

</div>

I am getting netflows from nprobe at Kibana. The template i am using while run nprobe is

_%IN\_SRC\_MAC %OUT\_DST\_MAC %INPUT\_SNMP %OUTPUT\_SNMP %SRC\_VLAN %IPV4\_SRC\_ADDR %IPV4\_DST\_ADDR %L4\_SRC\_PORT %L4\_DST\_PORT %IPV6\_SRC\_ADDR %IPV6\_DST\_ADDR %IP\_PROTOCOL\_VERSION %PROTOCOL %L7\_PROTO %IN\_BYTES %IN\_PKTS %OUT\_BYTES %OUT\_PKTS %FIRST\_SWITCHED %LAST\_SWITCHED %CLIENT\_TCP\_FLAGS %SERVER\_TCP\_FLAGS %CLIENT\_NW\_LATENCY\_MS %SERVER\_NW\_LATENCY\_MS %APPL\_LATENCY\_MS %OOORDER\_IN\_PKTS %OOORDER\_OUT\_PKTS %RETRANSMITTED\_IN\_PKTS %RETRANSMITTED\_OUT\_PKTS %SRC\_FRAGMENTS %DST\_FRAGMENTS %DNS\_QUERY %HTTP\_URL %HTTP\_SITE %TLS\_SERVER\_NAME %BITTORRENT\_HASH"_

But what i get in kibana is that field names are not properly mapped but just numbers. The values are rights but thier filed names are not correct. Any one can help/suggest solution.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/78f7332031b863c57df1ce96e6f9020fc5de0331.png)

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [July 1, 2020, 11:12am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816/2 "2020-07-01T11:12:26Z")

</div>

Hi

this seems to be not a Kibana problem, but a you need to check how your data is inserted in Elasticsearch, so you need to take a closer look an the nprobe configuration. sorry I can't support you here in a proper way, since I don't know nprobe. Just one question between nprobe and Elasticsearch, do you use Logstash in between?

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![muhammad.ashraf](https://avatars.discourse-cdn.com/v4/letter/m/96bed5/32.png) [@muhammad.ashraf](https://discuss.elastic.co/u/muhammad.ashraf)\
**Post date:** [July 2, 2020, 4:27am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816/3 "2020-07-02T04:27:24Z")

</div>

Hi

Thank you very much Matthias for your time, yes it was nprobe issue, I fixed it by using "--json-labels" at the end of my nprobe's command.

No, I'm not using Logstash, just telling the nprobe to sent flows directly to Elasticsearch like this:

**sudo nprobe --zmq "tcp://\*:5556" -i ens12 -n none -T "@NTOPNG@" --elastic "flows;nprobe-%Y.%m.%d;[http://localhost:9200/\_bulk](http://localhost:9200/_bulk)" --json-labels**

Best,  
Ashraf

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [July 2, 2020, 4:44am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816/4 "2020-07-02T04:44:31Z")

</div>

Interesting, thanks for sharing!  
Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2020, 4:44am UTC](https://discuss.elastic.co/t/issue-in-mapping-of-fileds/238816/5 "2020-07-30T04:44:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.