# Create a .raw field for a given field via Dynamic Template

**URL:** <https://discuss.elastic.co/t/create-a-raw-field-for-a-given-field-via-dynamic-template/85822>\
**Category:** Logstash\
**Created:** [May 15, 2017, 9:17pm UTC](https://discuss.elastic.co/t/create-a-raw-field-for-a-given-field-via-dynamic-template/85822 "2017-05-15T21:17:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![KingBob](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@KingBob](https://discuss.elastic.co/u/KingBob)\
**Post date:** [May 15, 2017, 9:17pm UTC](https://discuss.elastic.co/t/create-a-raw-field-for-a-given-field-via-dynamic-template/85822/1 "2017-05-15T21:17:56Z")

</div>

Hello,

I would like to modify the default Logstash template to create a `host.raw` field that is not analyzed (so it can be used in a terms query from Grafana).

I tried the following but it is not working.

Can anyone show me where I'm going wrong?

```
{
  "order" : 0,
  "version" : 50005,
  "template" : "logstash-*",
  "settings" : {
    "index" : {
      "number_of_shards" : "2",
      "number_of_replicas" : "1",
      "refresh_interval" : "5s"
    }
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [
        {
          "message_field" : {
            "path_match" : "message",
            "mapping" : {
              "norms" : false,
              "type" : "text"
            },
            "match_mapping_type" : "string"
          }
        },
        {
          "host_field" : {
            "path_match" : "host",
            "mapping" : {
              "type" : "string",
              "fields" : {
                "raw" : {
                  "ignore_above" : 256,
                  "index" : "not_analyzed",
                  "type" : "string"
                }
              }
            }
          }
        },
        {
          "string_fields" : {
            "mapping" : {
              "norms" : false,
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword"
                }
              }
            },
            "match_mapping_type" : "string",
            "match" : "*"
          }
        }
      ],
      "_all" : {
        "norms" : false,
        "enabled" : true
      },
      "properties" : {
        "@timestamp" : {
          "include_in_all" : false,
          "type" : "date"
        },
        "geoip" : {
          "dynamic" : true,
          "properties" : {
            "ip" : {
              "type" : "ip"
            },
            "latitude" : {
              "type" : "half_float"
            },
            "location" : {
              "type" : "geo_point"
            },
            "longitude" : {
              "type" : "half_float"
            }
          }
        },
        "@version" : {
          "include_in_all" : false,
          "type" : "keyword"
        }
      }
    }
  },
  "aliases" : { }
}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 9:24pm UTC](https://discuss.elastic.co/t/create-a-raw-field-for-a-given-field-via-dynamic-template/85822/2 "2017-06-12T21:24:03Z")

</div>

Closed on June 12, 2017, 9:24pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.