# Visualize "unkown" data fields

**URL:** <https://discuss.elastic.co/t/visualize-unkown-data-fields/118682>\
**Category:** Kibana\
**Created:** [February 6, 2018, 4:21pm UTC](https://discuss.elastic.co/t/visualize-unkown-data-fields/118682 "2018-02-06T16:21:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbeee](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@sbeee](https://discuss.elastic.co/u/sbeee)\
**Post date:** [February 6, 2018, 4:21pm UTC](https://discuss.elastic.co/t/visualize-unkown-data-fields/118682/1 "2018-02-06T16:21:44Z")

</div>

hi guys,

i've installed the syslog\_pri plugin to display syslog facility & severity. i also added a field for translation of severity numbers into strings like critical, warning etc.. this field is called "severity".

this all works as expected and will show up in kibana/discover.

now i want to visualize the count of severity labels (how many criticals, warnings etc. for a given time period).

my problem is...i can't visualize these new data fields because they fail to appear in the list of "terms" or "significant terms".

the reason for that could be the "unknown" data field type status!??! how can i change that?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 7, 2018, 7:56pm UTC](https://discuss.elastic.co/t/visualize-unkown-data-fields/118682/2 "2018-02-07T19:56:06Z")

</div>

hi @sbeee,

Not 100% sure what's going on, also not too familiar with logstash.

But this seems more like a logstash issue (?). All fields should be mapped with a known data-type.

What is the mapping of that index? It should show something like `"type": "keyword"` before it can be used in aggregations.

---

<div class="post-metadata">

**Author:** ![sbeee](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@sbeee](https://discuss.elastic.co/u/sbeee)\
**Post date:** [February 8, 2018, 9:08am UTC](https://discuss.elastic.co/t/visualize-unkown-data-fields/118682/3 "2018-02-08T09:08:19Z")

</div>

I've found the "issue". The trick is to refresh the index pattern manually via Management \> Kibana \> Index Patterns \> "Refresh field list"

The new data fields are now tagged as string etc. and can be used in the visualization module.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 9:08am UTC](https://discuss.elastic.co/t/visualize-unkown-data-fields/118682/4 "2018-03-08T09:08:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.