https://docs.logz.io/assets/js/14b12cc4.edcaf93f.js

1"use strict";(self.webpackChunkmy_website=self.webpackChunkmy_website||[]).push([[22569],{3905:(e,t,n)=>{n.d(t,{Zo:()=>p,kt:()=>m});var i=n(67294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function r(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function d(e,t){if(null==e)return{};var n,i,o=function(e,t){if(null==e)return{};var n,i,o={},a=Object.keys(e);for(i=0;i<a.length;i++)n=a[i],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(i=0;i<a.length;i++)n=a[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=i.createContext({}),s=function(e){var t=i.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):r(r({},t),e)),n},p=function(e){var t=s(e.components);return i.createElement(l.Provider,{value:t},e.children)},c="mdxType",u={inlineCode:"code",wrapper:function(e){var t=e.children;return i.createElement(i.Fragment,{},t)}},f=i.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,p=d(e,["components","mdxType","originalType","parentName"]),c=s(n),f=o,m=c["".concat(l,".").concat(f)]||c[f]||u[f]||a;return n?i.createElement(m,r(r({ref:t},p),{},{components:n})):i.createElement(m,r({ref:t},p))}));function m(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,r=new Array(a);r[0]=f;var d={};for(var l in t)hasOwnProperty.call(t,l)&&(d[l]=t[l]);d.originalType=e,d[c]="string"==typeof e?e:o,r[1]=d;for(var s=2;s<a;s++)r[s]=n[s];return i.createElement.apply(null,r)}return i.createElement.apply(null,n)}f.displayName="MDXCreateElement"},3592:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>r,default:()=>u,frontMatter:()=>a,metadata:()=>d,toc:()=>s});var i=n(87462),o=(n(67294),n(3905));const a={sidebar_position:2,title:"Field Not Indexed",image:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg",description:"Troubleshoot Field Not Indexed issue in OpenSearch Dashboards",keywords:["troubleshoot","field","log","mapping","observability","monitoring","issues"]},r=void 0,d={unversionedId:"open360/data-hub/field-mapping/field-not-indexed",id:"open360/data-hub/field-mapping/field-not-indexed",title:"Field Not Indexed",description:"Troubleshoot Field Not Indexed issue in OpenSearch Dashboards",source:"@site/docs/open360/data-hub/field-mapping/field-not-indexed.md",sourceDirName:"open360/data-hub/field-mapping",slug:"/open360/data-hub/field-mapping/field-not-indexed",permalink:"/docs/open360/data-hub/field-mapping/field-not-indexed",draft:!1,editUrl:"https://github.com/logzio/documentation/tree/master/docs/open360/data-hub/field-mapping/field-not-indexed.md",tags:[],version:"current",sidebarPosition:2,frontMatter:{sidebar_position:2,title:"Field Not Indexed",image:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg",description:"Troubleshoot Field Not Indexed issue in OpenSearch Dashboards",keywords:["troubleshoot","field","log","mapping","observability","monitoring","issues"]},sidebar:"tutorialSidebar",previous:{title:"Field Mapping",permalink:"/docs/open360/data-hub/field-mapping/"},next:{title:"Warm Tier",permalink:"/docs/open360/data-hub/warm-tier"}},l={},s=[{value:"If a field is not indexed",id:"if-a-field-is-not-indexed",level:3},{value:"Add a field to OpenSearch Dashboards&#39; default mapping",id:"add-a-field-to-opensearch-dashboards-default-mapping",level:3}],p={toc:s},c="wrapper";

1function u(e){let{components:t,...n}=e;return(0,o.kt)(c,(0,i.Z)({},p,n,{components:t,mdxType:"MDXLayout"}),(0,o.kt)("p",null,"Sometimes, it will appear that a field in OpenSearch Dashboards is not mapped. The mapping icon will show a ?",(0,o.kt)("i",{class:"fas fa-question"})," question mark, indicating that the field is not mapped. "),(0,o.kt)("p",null,(0,o.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/kibana/field-not-indexed_aug2021.png",alt:"field not indexed"})),(0,o.kt)("p",null,"Whenever you see the message ",(0,o.kt)("strong",{parentName:"p"},"Field not indexed"),", this is simply an indication that the field is not indexed because nothing in your OpenSearch Dashboards account is dependent on it. It wasn't required for any of your account's alerts, filters, saved searches, visualizations, dashboards, or any other objects."),(0,o.kt)("h3",{id:"if-a-field-is-not-indexed"},"If a field is not indexed"),(0,o.kt)("p",null,"If a field is not mapped in your logs, there are a few actions you won't be able to perform on it:"),(0,o.kt)("ol",null,(0,o.kt)("li",{parentName:"ol"},"You can't visualize it."),(0,o.kt)("li",{parentName:"ol"},"You can't filter on it. It simply won\u2019t appear in the drop-down filter list.")),(0,o.kt)("h3",{id:"add-a-field-to-opensearch-dashboards-default-mapping"},"Add a field to OpenSearch Dashboards' default mapping"),(0,o.kt)("p",null,"You can always add a field to the list of required fields."),(0,o.kt)("p",null,"In OpenSearch Dashboards, on the left preview menu, identify the unmapped field. Click on the unmapped field to select it and click on the button ",(0,o.kt)("strong",{parentName:"p"},"Field not indexed"),"."),(0,o.kt)("p",null,"The field will now be added to your default OpenSearch Dashboards mapping."))}u.isMDXComponent=!0}}]);