"no cached mapping for this field"

I've seen that a warning from the topic subject makes some troubles also for other users on this forum, but I believe this one is new here.
this warning shows for a field with epoch timestamp value. after some time I finally did ingest (via syslog) it with a set indexing template (otherwise it would be interpreted as a number).
while looking at the event in Kibana the field is "Unkonwn field" and the value (shows as a number) has this "no cached ...".
GET my_index/_mapping/field/timestamp_event

      "my_index" : {
        "mappings" : {
          "timestamp_event" : {
            "full_name" : "timestamp_event",
            "mapping" : {
              "timestamp_event" : {
                "type" : "date",
                "format" : "epoch_second"

I would like to see it as a human readable date not a strange number, but can't make it even though countless refreshing, index deletes, ingests and Kibana restarts.
Any idea what I did wrong? Seems I can't find it myself :confused:


heh, ok. i don't know what has happened. just checked this afternoon.
machine restart (it's a single virtual machine with the elastic + kibina on it) helped. but this not sth that I would like to see on production environment or a diagnosing method. date is correct and no warning info in Kibana.
any ideas? both Kibana and Elastic logs are clear. also API output doesn't shown any signs of concern.


Did you try to refresh the mapping of the index pattern?

yes, that was the first thing I did. actually, few times. event tried to get rid of the index and populate it from the very beginning.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.