# Multiple unmapped / unknow Elastic Agent log fields

**URL:** <https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653>\
**Category:** Elastic Agent\
**Created:** [June 1, 2024, 9:24am UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653 "2024-06-01T09:24:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [June 1, 2024, 9:24am UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653/1 "2024-06-01T09:24:39Z")

</div>

Hello,

I noticed a lot of Elastic Agent log fields have a question mark and seem unmapped. Imho it would be useful if we can aggregate on these fields. Could the mapping please be updated so these fields can be used properly?

For example in .ds-logs-elastic\_agent.filebeat-default-2024.05.30-000037

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/960908c3696f5b5038afcae0e78f1dbcb34c03c9.png)

Willem

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 1, 2024, 2:00pm UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653/2 "2024-06-01T14:00:07Z")

</div>

What is the integration that you are using? Did the question mark still persists after a refresh?

This normally happens when you are seeing in discover and the field has not appeared before in the data view, but a refresh would fix it.

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [June 1, 2024, 3:55pm UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653/3 "2024-06-01T15:55:35Z")

</div>

These the builtin logs of the Elastic Agents

---

<div class="post-metadata">

**Author:** ![jeffabar](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jeffabar](https://discuss.elastic.co/u/jeffabar)\
**Post date:** [January 28, 2025, 7:54pm UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653/4 "2025-01-28T19:54:45Z")

</div>

I am running into this as well with logs-elastic\_agent.fleet\_server-default

How do I tell which integration is responsible for this?

What does "refresh" mean?

Thank you, Jeff