# Refresh doesn't help with question marks

**URL:** <https://discuss.elastic.co/t/refresh-doesnt-help-with-question-marks/172599>\
**Category:** Kibana\
**Created:** [March 15, 2019, 7:50pm UTC](https://discuss.elastic.co/t/refresh-doesnt-help-with-question-marks/172599 "2019-03-15T19:50:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [March 15, 2019, 7:50pm UTC](https://discuss.elastic.co/t/refresh-doesnt-help-with-question-marks/172599/1 "2019-03-15T19:50:28Z")

</div>

I renamed winlogbeat fields in logstash

```
filter {
    if [event_id] == 4624 {
      # https://github.com/MicrosoftDocs/windows-itpro- 
  docs/blob/master/windows/security/threat-protection/auditing/event-4624.md
          mutate {
            rename => {
              "[event_data][SubjectUserSid]" => "user_reporter_sid"
              "[event_data][SubjectUserName]" => "user_reporter_name"
              "[event_data][SubjectDomainName]" => "user_reporter_domain"
              "[event_data][SubjectLogonId]" => "reporter_logon_id"
              "[event_data][TargetLogonId]" => "user_logon_id"
              "[event_data][LogonType]" => "logon_type"

```

\*\*\*Roberto Rodriguez is the man!!!!! [@ **Cyb3rWard0g**](https://twitter.com/Cyb3rWard0g)

Buuuuut I keep getting ? in Kibana for the renamed fields

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00e9f7a09261d1e3a368dada0327574e7ec4ddc1.png)

No matter how many times I refresh ...  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2ae1535357ec9d4201e2b40e1cbf574c45d210a1.png)

Anything I can do... thanks!

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [March 15, 2019, 9:45pm UTC](https://discuss.elastic.co/t/refresh-doesnt-help-with-question-marks/172599/2 "2019-03-15T21:45:26Z")

</div>

Close it... way too impatient sometimes.

Thanks!

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 22, 2019, 10:47am UTC](https://discuss.elastic.co/t/refresh-doesnt-help-with-question-marks/172599/3 "2019-03-22T10:47:30Z")

</div>