# Can't find terms that are not ".keyword" and the "something.keyword" terms are empty
**URL:** https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998
**Category:** Kibana
**Created:** [April 13, 2021, 11:51am UTC](https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998 "2021-04-13T11:51:10Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [April 13, 2021, 11:51am UTC](https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998/1 "2021-04-13T11:51:11Z")
Hi, I've been playing a little bit with mappings and index templates lately, and that actually helped me make the SIEM work and see a lot of improvement. However, many of my visualizations just stopped working, mainly because they used to depend on "foo.keyword" terms that now are apparently empty... In many cases I could find the corresponding term without the ".keyword", but in some others I can only find "food.keyword" and therefore can't fix the visualization. My guess is that it has something to do with mapping, but I have no clue how to fix things. I've tried reindexing, refreshing index patterns, assigning legacy templates, but nothing. Could you please help me?
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [April 14, 2021, 11:30am UTC](https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998/2 "2021-04-14T11:30:05Z")
If you change the underlying mapping, visualizations might stop working because they are referencing the old field names. The only way to fix it is going through all visualizations and fixing the problems by hand.
If a field went away, then you might have renamed it or don't index it as `keyword` field type anymore (this is necessary for visualizations because `text` fields are not aggregatable).
If you are stuck at specific places, feel free to post the context (your visualization and the mapping of your indices) and I can help you fixing them.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [April 22, 2021, 8:17am UTC](https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998/3 "2021-04-22T08:17:13Z")
Thank you, I think I fixed it but I'm not entirely sure how. I did 3 things:
1. Created an index template with very few mappings for source and host objects, and assigned it to my index templates.
2. Copied a Legacy Index Template from logstash-ecs and assigned it to my index templates as well.
3. Created a new index template that uses comma-separated indices rather than a wildcard.
I am guessing the one that actually did the trick was 1 and 3. But after doing that and reindexing, I was able to aggregate the terms again. Also played defining`message` as keyword instead of text which made it available for aggregation once again, but I now understand why is not recommended.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2021, 8:18am UTC](https://discuss.elastic.co/t/cant-find-terms-that-are-not-keyword-and-the-something-keyword-terms-are-empty/269998/4 "2021-05-20T08:18:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.