"no cached mapping for this field"

Elastic Stack Kibana
1

hello
I've seen that a warning from the topic subject makes some troubles also for other users on this forum, but I believe this one is new here.
this warning shows for a field with epoch timestamp value. after some time I finally did ingest (via syslog) it with a set indexing template (otherwise it would be interpreted as a number).
while looking at the event in Kibana the field is "Unkonwn field" and the value (shows as a number) has this "no cached ...".
GET my_index/_mapping/field/timestamp_event

 {
      "my_index" : {
        "mappings" : {
          "timestamp_event" : {
            "full_name" : "timestamp_event",
            "mapping" : {
              "timestamp_event" : {
                "type" : "date",
                "format" : "epoch_second"

I would like to see it as a human readable date not a strange number, but can't make it even though countless refreshing, index deletes, ingests and Kibana restarts.
Any idea what I did wrong? Seems I can't find it myself :confused:

regards!

2

heh, ok. i don't know what has happened. just checked this afternoon.
machine restart (it's a single virtual machine with the elastic + kibina on it) helped. but this not sth that I would like to see on production environment or a diagnosing method. date is correct and no warning info in Kibana.
any ideas? both Kibana and Elastic logs are clear. also API output doesn't shown any signs of concern.

regards

3

Did you try to refresh the mapping of the index pattern?

4

yes, that was the first thing I did. actually, few times. event tried to get rid of the index and populate it from the very beginning.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.