No cached mapping for this field!

[padamrai]

I tried the management -> index pattern and hit refreshed button still I am not getting these fields. In the discover window,

I am seeing these fields with warning tags but I am not getting these fields while using index_name/_mapping.

Also, these fields are not searchable in the discover panel.

Please help me how to resolve this issue.

[jsanz (Jorge Sanz)]

Which version of the stack are you using? 7.10 was the last version that cached the fields definitions (PR)

I've tested the following with 7.15:

# Create an index with some docs
DELETE test_warning_fields

PUT test_warning_fields
{
  "mappings": {
    "properties": {
      "field1": { "type": "text"},
      "field2": { "type": "text"},
      "field3": { "type": "text"},
      "field4": { "type": "text"}
    }
  }
}

POST test_warning_fields/_bulk
{ "index" : { "_id" : "1" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}
{ "index" : { "_id" : "2" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}
{ "index" : { "_id" : "3" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}
{ "index" : { "_id" : "4" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}
{ "index" : { "_id" : "5" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}
{ "index" : { "_id" : "6" } }
{ "field1" : "value1", "field2" : "value1","field3" : "value1","field4" : "value1"}


# Create the index pattern
# Check in Discover, all OK

Then I regenerated the index with different fields to try to break Kibana:

# Regenerate the index with other fields
DELETE test_warning_fields

PUT test_warning_fields
{
  "mappings": {
    "properties": {
      "field5": { "type": "text"},
      "field6": { "type": "text"},
      "field7": { "type": "text"},
      "field8": { "type": "text"}
    }
  }
}

POST test_warning_fields/_bulk
{ "index" : { "_id" : "1" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}
{ "index" : { "_id" : "2" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}
{ "index" : { "_id" : "3" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}
{ "index" : { "_id" : "4" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}
{ "index" : { "_id" : "5" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}
{ "index" : { "_id" : "6" } }
{ "field5" : "value5", "field6" : "value1","field7" : "value1","field8" : "value1"}

But the index pattern and discover reflected the new schema

Hope it helps!

[stephenb (Stephen Brown)]

What version are you on

If you're on an older version a simple refresh in the browser won't pull the new index pattern definitions into discover You will need to do a shift refresh or full hard refresh / reload of the page.

This behavior has changed in recent releases but highly recommend upgrading if you're on an older version.

[padamrai]

I have 7.11.0 elk stack version.

[stephenb (Stephen Brown)]

Assuming as you said you wen to the Index Pattern Refreshed it, saw that those fields now exist in the index pattern.

Then test by opening Discover in a new incognito window, or make sure you do a full hard refresh of the Discover page, this is a know issue on older versions

[padamrai]

It is because of null data fields when I send data with these fields and again refreshed it, it works perfectly fine.