# Configuration in index file to avoid default keyword type generation

**URL:** <https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921>\
**Category:** Elasticsearch\
**Created:** [October 25, 2018, 6:35am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921 "2018-10-25T06:35:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![saraswati](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@saraswati](https://discuss.elastic.co/u/saraswati)\
**Post date:** [October 25, 2018, 6:35am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921/1 "2018-10-25T06:35:47Z")

</div>

How to create index file which creates only type text and not type keyword.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 25, 2018, 7:24am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921/2 "2018-10-25T07:24:03Z")

</div>

You can mark the field in the mapping just as a `text` datatype, see the [text datatype documentation](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/text.html#text)

---

<div class="post-metadata">

**Author:** ![saraswati](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@saraswati](https://discuss.elastic.co/u/saraswati)\
**Post date:** [October 25, 2018, 8:13am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921/3 "2018-10-25T08:13:51Z")

</div>

Hi ,  
my question is how to make all fields in audit index as text because audit-index file always holds text and keyword type for string fields.  
so because of this that file size gets larger or double and also two names gets created for 1 field and break audit logs for mismatch fields mapping.

Thanks ,  
saraswati

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 25, 2018, 9:32am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921/4 "2018-10-25T09:32:45Z")

</div>

you can use the match mapping type within an index template, see [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/dynamic-templates.html#match-mapping-type](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/dynamic-templates.html#match-mapping-type)

If this is an index created by one of the beats (auditbeat) I personally would try to not change the mapping unless absolutely necessary.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2018, 9:32am UTC](https://discuss.elastic.co/t/configuration-in-index-file-to-avoid-default-keyword-type-generation/153921/5 "2018-11-22T09:32:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.