# Visualisation: Term, field not in list **URL:** \ **Category:** Kibana\ **Created:** [May 16, 2021, 8:50pm UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116 "2021-05-16T20:50:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [May 16, 2021, 8:50pm UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/1 "2021-05-16T20:50:41Z")
I am trying to make a standard time on x axis stacked bar chart but when I try and split the bar the on a term the field I want to use is not listed. here is a sample raw record (trimmed for brevity). Important fields are `event_type` (primary aggregation and `rule_id` the term I am trying to split the bar on. ```auto @timestamp. 2021 05 17 @ 08:07:05 +12:00 action blocked dst_ip 104.21.28.12 event_type FilteredWebsites_Event rule_id Blocked by internal blacklist severity Warning ``` mapping for rule\_id is `keyword`. Visualisation filter is `event_type : FilteredWebsites_Event` ![Screen Shot 2021-05-17 at 8.45.34 AM](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49a913dea2c6ecde213d2768ca26db2831a056c0.png) and rule\_id is not in the selection list. Any ideas as to what is going on? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 16, 2021, 9:29pm UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/2 "2021-05-16T21:29:49Z")
That typically means the field is not defined as a `keyword` You said that you define it as a `keyword` so it's possible that the index pattern needs to be refreshed if you are on a version before 7.10 or so ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [May 16, 2021, 10:24pm UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/3 "2021-05-16T22:24:49Z")
Ah! I know what the issue is: the index is a datastream and i need to force it to rollover to get the revised mapping visible to kibana. BTW I could not find a way of forcing and index to rollover other than tweaking the ILM policy **and** remembering to remove the tweak once the rollover happens. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 19, 2021, 1:15am UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/4 "2021-05-19T01:15:28Z")
@Russell_Fulton Learned this today... [The rollover API](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/indices-rollover-index.html).... huh who knew, good ta have the back pocket, you wont need to mess with the ILM next time you want to do it. `POST //_rollover/` you can even dry run it! `POST //_rollover/?dry_run` ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [May 19, 2021, 1:43am UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/5 "2021-05-19T01:43:09Z")
Doh! I am sure I looked at the rollover API at one stage and then forgot about ! Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2021, 1:44am UTC](https://discuss.elastic.co/t/visualisation-term-field-not-in-list/273116/6 "2021-06-16T01:44:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.