Sometimes, it will appear that a field in Kibana is not mapped. The mapping icon will show a question mark indicating that the field is not mapped in Kibana.
Whenever you see the message Field not indexed, this is simply an indication that the field is not indexed because nothing in your Kibana account is dependent on it. It wasn’t required for any of your account’s alerts, filters, saved searches, visualizations, dashboards, or any other Kibana objects.
If a field is not indexed
If a field is not mapped in Kibana, there are a few actions you won’t be able to perform on it:
- You can’t visualize it.
- You can’t filter on it. It simply won’t appear in the drop-down filter list.
Add a field to Kibana’s default mapping
You can always add a field to Kibana’s list of required fields.
In Kibana Discover, on the left preview menu, identify the unmapped field. Click on the unmapped field to select it and click on the button Field not indexed.
The field will now be added to your default Kibana mapping.