With newly indexed Elastic Stack Elasticsearch documents (from Elastic APM or Filebeat/Logstash for example) you may see a warning “No cached mapping for this field. Refresh field list from the Management > Index Patterns page.” in Kibana when inspecting an event.
To refresh the field list from Kibana you can go into the Management tab from the navigation on the left-hand side, then Index Patterns.
There should be a refresh icon in the top-right, which should notify you that “This action resets the popularity counter of each field.”
Repeat this for any indices you would like the fields automatically mapped for (in the above example we are automatically mapping the fields that Filebeat is populating in each event)
Return to the Discover tab and the warnings should be gone! Note this will only work if Elasticsearch is able to accurately determine a consistent data type for each field.
1000 thanks. Regards
This was exceptionally helpful! Also it was significantly simpler than I thought I was going to have to do to get my log entry searchable. Thanks!