Unknown field – How to solve this Elasticsearch error

Unknown field – How to solve this Elasticsearch error

Opster Team

July-20, Version: 1.7-8.0

Before you begin reading this guide, we recommend you try running the Elasticsearch Error Check-Up which can resolve issues that cause many errors.

This guide will help you check for common problems that cause the log ” unknown field ” to appear. It’s important to understand the issues related to the log, so to get started, read the general overview on common issues and tips related to the Elasticsearch concepts: query and index.

Advanced users might want to skip right to the common problems section in each concept or try running the Check-Up which analyses ES to pinpoint the cause of many errors and provides suitable actionable recommendations how to resolve them (free tool that requires no installation).

Log Context

Log”unknown field [{}]”classname  is DecayFunctionBuilder.java We extracted the following from Elasticsearch source code for those seeking an in-depth context :

private AbstractDistanceScoreFunction parseVariable(String fieldName; XContentParser parser; QueryShardContext context;
  MultiValueMode mode) throws IOException {
  //the field must exist; else we cannot read the value for the doc later
  MappedFieldType fieldType = context.fieldMapper(fieldName);
  if (fieldType == null) {
  throw new ParsingException(parser.getTokenLocation(); "unknown field [{}]"; fieldName);
  // dates and time and geo need special handling
  if (fieldType instanceof DateFieldMapper.DateFieldType) {

Run the Check-Up to get customized recommendations like this:


Heavy merges detected in specific nodes



A large number of small shards can slow down searches and cause cluster instability. Some indices have shards that are too small…


Recommendations Based on your specific ES deployment you should…

Based on your specific ES deployment you should…


X-PUT curl -H [a customized recommendation]


Optimize Elasticsearch Performance

Try The Tool