# Kibana Unknown Field Type

**URL:** https://discuss.elastic.co/t/kibana-unknown-field-type/202851
**Category:** Kibana
**Created:** [October 9, 2019, 2:37pm UTC](https://discuss.elastic.co/t/kibana-unknown-field-type/202851 "2019-10-09T14:37:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Junebee](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Junebee](https://discuss.elastic.co/u/Junebee)
#### Post date: [October 9, 2019, 2:37pm UTC](https://discuss.elastic.co/t/kibana-unknown-field-type/202851/1 "2019-10-09T14:37:06Z")

</div>

There is a field (\_path) in my Kibana Discovery tab which shows up as unknown type (?) yet it is listed in my dynamic template mapping as "keyword". Everything else in the template works great.

The data in \_path is simply the name of a Zeek log. I.e. conn, dns, etc.

Can anyone explain how to get \_path to show up as keyword instead of unknown? I've also tried making the type "text" as well but that didn't work either.

Thanks ahead of time!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1e61c95e9aeebb05227b2a282beac35f1bf4899.png)

"logstash-2019.10.08": {

- "mappings": {
  - "dynamic\_templates": [
    - {
      - "message\_field": {
        - "path\_match": "message",
        - "match\_mapping\_type": "string",
        - "mapping": {
          - "norms": false,
          - "type": "text"}}}  
, \* {

      - "string\_fields": {
        - "match": "\*",
        - "match\_mapping\_type": "string",
        - "mapping": {
          - "fields": {
            - "keyword": {
              - "ignore\_above": 256,
              - "type": "keyword"}},

          - "norms": false,
          - "type": "text"}}}],

  - "properties": {
    - "@timestamp": {
      - "type": "date"},

    - "@version": {
      - "type": "keyword"},

    - "\_path": {
      - "type": "keyword"},

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [October 9, 2019, 11:02pm UTC](https://discuss.elastic.co/t/kibana-unknown-field-type/202851/2 "2019-10-09T23:02:27Z")

</div>

This generally occurs when your index pattern matches indices that have conflicting field types in their mappings. Can you take a look at your index pattern under management \> Index Patterns and inspect the `_path` field? You should see a list of indices and the conflicting types similar to this screenshot:

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a677ce2dccfd3de64f670ccf74677f088c93d1f.png)

This is from 7.2 so it might look slightly different for you depending on which version you're using. Once you've identified the index or indices which have the wrong mapping, you can fix this by reindexing the data into indices with the correct mappings defined. Here are some resources:

- [How to fix mapping conflict?](https://discuss.elastic.co/t/how-to-fix-mapping-conflict/55072/3)
- [Mapping conflict!](https://discuss.elastic.co/t/mapping-conflict/40248/6)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 6, 2019, 11:02pm UTC](https://discuss.elastic.co/t/kibana-unknown-field-type/202851/3 "2019-11-06T23:02:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.