# All String fields are splitting for / - \_

**URL:** <https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [November 6, 2015, 9:41pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059 "2015-11-06T21:41:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![slourenco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slourenco/32/5780_2.png) [@slourenco](https://discuss.elastic.co/u/slourenco)\
**Post date:** [November 6, 2015, 9:41pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059/1 "2015-11-06T21:41:09Z")

</div>

After upgrading and loading the new index file to elasticsearch, all data on dashboards are splitting and grouping by the the parts the field like query, path and so on.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/81c669636df23b864bcd034c5bd37e5d05d0cb29.png)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 6, 2015, 11:31pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059/2 "2015-11-06T23:31:00Z")

</div>

did you apply the elasticsearch templates? Looks like these fields are set to analyzed, but should not. In kibana settings page you can check fields being analyzed or not (and data types)

---

<div class="post-metadata">

**Author:** ![slourenco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slourenco/32/5780_2.png) [@slourenco](https://discuss.elastic.co/u/slourenco)\
**Post date:** [November 7, 2015, 5:26pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059/3 "2015-11-07T17:26:28Z")

</div>

I did applied the elastic templates from the packetbeat.template.json on it, but still nothing 😕  
Is there anyway to do that add the field.raw for all string fields and keep the collected data ?

Thanks

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 9, 2015, 5:57pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059/4 "2015-11-09T17:57:21Z")

</div>

the templates must be applied to elasticsearch before indexing. You cannot change the mapping retroactively.

Either drop you indexes or consider reindexing: [https://www.elastic.co/guide/en/elasticsearch/guide/current/reindex.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/reindex.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/all-string-fields-are-splitting-for--/34059/5 "2017-07-05T21:58:19Z")

</div>