field no cashed mapping

Diaz

Hello,

I have setup ELS and have been performing some testing and have noticed that I have a warning on match_body fields. On the Global Dashboard
Error: No cached mapping for this field. Refresh field list from the management > Index Patterns page.
The fields are not enabled indefault-alert-indice template as you can see

I would like to change the mapping to "enabled: true" in the following code snippet in the file. But I am not sure of the implications, as this might sometimes results in mapping parsing exception error and not indexing of the necessary data.
Please advise on the same.

SzymonC

Hi,

Good question.
By default this option is set on false. This option demands verification (for the conflicts) and normalization (to avoid future conflicts) of all the fields in all indexes that will be monitored by alerts. This takes time.
If you can guarantee that no field will have conflicts, meaning all your data will be normalized, then changing this to enabled is generally good idea.
You don't have to worry about indexes that you know won't be monitored by alerts.