Kibana unknown index pattern fields

Elastic Stack Kibana
1

Hello,
I'm trying to do aggregations on some fields in my index pattern, but they are unknown. I've tried refresh index pattern but they still don't show in Stack managment. On the other hand, I can see them in my discover tab.
I think the solution has to do something with dynamic mapping, but I'm getting a new index in my index pattern every day.
My indexes look like this:

indexExample-2020-10-18
indexExample-2020-10-19
indexExample-2020-10-20
...

And I've created index pattern looks like this:

indexExample-*

It covers every index in elasticksearch as I know.
Is there any way to handle that unknown field and map them to index pattern, or some sort of hack to set every index's dynamic option to true?

2

Hi

Could you share the mapping of you indices? I assume they are displayed in Discover as unknown fields, so I guess they are not mapped, to the solution to you problem might be taking care of the mapping of you indices.

Thx & Best,
Matthias

3

Thanks @matw for quick response.
his is that field in every index in the index pattern

image

4

You need to enable those fields , else you can't aggregate etc., have a look:

Best,
Matthias

2 Likes
5

Yes @matw I've tried many times, but when I run code:

PUT zipkin-span-2020-10-10
{
  "mappings": {
    "properties": {
      "tags": {
        "type": "object",
        "enabled": true
      }
    }
  }
}

I get this error:

"error" : {
    "root_cause" : [
      {
        "type" : "resource_already_exists_exception",
        "reason" : "index [zipkin-span-2020-10-10/J6vJaygsSxmIyit37MSzDw] already exists",
        "index_uuid" : "J6vJaygsSxmIyit37MSzDw",
        "index" : "zipkin-span-2020-10-10"
      }
    ],
    "type" : "resource_already_exists_exception",
    "reason" : "index [zipkin-span-2020-10-10/J6vJaygsSxmIyit37MSzDw] already exists",
    "index_uuid" : "J6vJaygsSxmIyit37MSzDw",
    "index" : "zipkin-span-2020-10-10"
  },
  "status" : 400

I cannot find any solution...
Thanks for your reply.

6

Find a solution in Stack Management > Data > Index Management and then in Index Templates, I change the mapping for that specific field.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.