# Kibana unknown index pattern fields

**URL:** <https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803>\
**Category:** Kibana\
**Created:** [October 21, 2020, 8:36am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803 "2020-10-21T08:36:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sh3ldoris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sh3ldoris/32/76665_2.png) [@Sh3ldoris](https://discuss.elastic.co/u/Sh3ldoris)\
**Post date:** [October 21, 2020, 8:36am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/1 "2020-10-21T08:36:20Z")

</div>

Hello,  
I'm trying to do aggregations on some fields in my index pattern, but they are unknown. I've tried refresh index pattern but they still don't show in Stack managment. On the other hand, I can see them in my discover tab.  
I think the solution has to do something with dynamic mapping, but I'm getting a new index in my index pattern every day.  
My indexes look like this:

```auto
indexExample-2020-10-18
indexExample-2020-10-19
indexExample-2020-10-20
...

```

And I've created index pattern looks like this:

```auto
indexExample-*

```

It covers every index in elasticksearch as I know.  
Is there any way to handle that unknown field and map them to index pattern, or some sort of hack to set every index's dynamic option to true?

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [October 21, 2020, 8:45am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/2 "2020-10-21T08:45:25Z")

</div>

Hi

Could you share the mapping of you indices? I assume they are displayed in Discover as unknown fields, so I guess they are not mapped, to the solution to you problem might be taking care of the mapping of you indices.

Thx & Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![Sh3ldoris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sh3ldoris/32/76665_2.png) [@Sh3ldoris](https://discuss.elastic.co/u/Sh3ldoris)\
**Post date:** [October 21, 2020, 9:02am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/3 "2020-10-21T09:02:41Z")

</div>

Thanks @matw for quick response.  
his is that field in every index in the index pattern

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16cc77f746e9d5645e170d5c91334bb15992f03b.png)

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [October 21, 2020, 9:16am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/4 "2020-10-21T09:16:04Z")

</div>

You need to enable those fields , else you can't aggregate etc., have a look:

> **[enabled | Elasticsearch Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/enabled.html)**

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![Sh3ldoris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sh3ldoris/32/76665_2.png) [@Sh3ldoris](https://discuss.elastic.co/u/Sh3ldoris)\
**Post date:** [October 23, 2020, 6:55am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/5 "2020-10-23T06:55:15Z")

</div>

Yes @matw I've tried many times, but when I run code:

```auto
PUT zipkin-span-2020-10-10
{
  "mappings": {
    "properties": {
      "tags": {
        "type": "object",
        "enabled": true
      }
    }
  }
}

```

I get this error:

```auto
"error" : {
    "root_cause" : [
      {
        "type" : "resource_already_exists_exception",
        "reason" : "index [zipkin-span-2020-10-10/J6vJaygsSxmIyit37MSzDw] already exists",
        "index_uuid" : "J6vJaygsSxmIyit37MSzDw",
        "index" : "zipkin-span-2020-10-10"
      }
    ],
    "type" : "resource_already_exists_exception",
    "reason" : "index [zipkin-span-2020-10-10/J6vJaygsSxmIyit37MSzDw] already exists",
    "index_uuid" : "J6vJaygsSxmIyit37MSzDw",
    "index" : "zipkin-span-2020-10-10"
  },
  "status" : 400

```

I cannot find any solution...  
Thanks for your reply.

---

<div class="post-metadata">

**Author:** ![Sh3ldoris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sh3ldoris/32/76665_2.png) [@Sh3ldoris](https://discuss.elastic.co/u/Sh3ldoris)\
**Post date:** [November 5, 2020, 9:35am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/6 "2020-11-05T09:35:58Z")

</div>

Find a solution in **Stack Management \> Data \> Index Management** and then in **Index Templates** , I change the mapping for that specific field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2020, 9:36am UTC](https://discuss.elastic.co/t/kibana-unknown-index-pattern-fields/252803/7 "2020-12-03T09:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.