# No cached mapping

**URL:** <https://discuss.elastic.co/t/no-cached-mapping/170210>\
**Category:** Kibana\
**Created:** [February 27, 2019, 5:21pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210 "2019-02-27T17:21:02Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mroell](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mroell](https://discuss.elastic.co/u/mroell)\
**Post date:** [February 27, 2019, 5:21pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/1 "2019-02-27T17:21:02Z")

</div>

I've been having an issue with a few fields that have the "No cached mapping for this ...." warning message. I asked about this issue in the logstash (I wanted to make sure the config wasn't the problem) forum and was told to check here.

I'm using the information from this site, and everything is working expect for a few fields. [https://www.syspanda.com/index.php/2018/05/03/monitoring-active-directory-elk/](https://www.syspanda.com/index.php/2018/05/03/monitoring-active-directory-elk/)

![No-Cached](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a1a4537b627e5e20d209567b983b3e3ac129d8e.png)

I've refreshed the Index Patterns multiple times to no avail. However upon some research I did see some information about nesting, I'm sure if that my issue here or not.

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 6:48pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/2 "2019-02-27T18:48:24Z")

</div>

Not sure what that could be.

Is that `Method` field a nested field?

---

<div class="post-metadata">

**Author:** ![mroell](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mroell](https://discuss.elastic.co/u/mroell)\
**Post date:** [February 27, 2019, 7:11pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/3 "2019-02-27T19:11:37Z")

</div>

It very well could be nested, however I don't know how to tell if it is.

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 7:55pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/4 "2019-02-27T19:55:15Z")

</div>

you can run a `_search` in the dev-console against that index, and see what kind of data-structure you get back in the raw response from Elasticsearch.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html)

---

<div class="post-metadata">

**Author:** ![mroell](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mroell](https://discuss.elastic.co/u/mroell)\
**Post date:** [February 27, 2019, 8:16pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/5 "2019-02-27T20:16:35Z")

</div>

When I run a search on that index the field "Method" is not there, I ran a few different searches just to make sure and in all of them the field was not present. So I guess that means that it's not nested?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 8:27pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/6 "2019-02-27T20:27:28Z")

</div>

hmm.. that's probably the problem (?)

you can also check if your actual index has the field explicitly defined. Try `myindex/_mapping`, and check what data-type the `Method` field has there.

---

<div class="post-metadata">

**Author:** ![mroell](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mroell](https://discuss.elastic.co/u/mroell)\
**Post date:** [February 27, 2019, 9:25pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/7 "2019-02-27T21:25:24Z")

</div>

Well I found my field:

```
      "method" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword"
          }
        }
      },

```

Does this tell you what you need to know?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 9:59pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/8 "2019-02-27T21:59:28Z")

</div>

hmmm... that field-name looks wrong in the kibana-index-pattern. It should be `method` with lowercase m.

---

<div class="post-metadata">

**Author:** ![mroell](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mroell](https://discuss.elastic.co/u/mroell)\
**Post date:** [February 27, 2019, 11:32pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/9 "2019-02-27T23:32:34Z")

</div>

Wow, that worked. I'm not even sure how that happened, but thank you for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2019, 11:32pm UTC](https://discuss.elastic.co/t/no-cached-mapping/170210/10 "2019-03-27T23:32:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.