# Custom mapping in Trend Micro Vision One integration

**URL:** <https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983>\
**Category:** Elasticsearch\
**Created:** [December 14, 2024, 5:58pm UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983 "2024-12-14T17:58:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [December 14, 2024, 5:58pm UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983/1 "2024-12-14T17:58:02Z")

</div>

Hi all,  
in Trend Micro Vision One integration, I added a custom pipeline:  
{  
"json": {  
"field": "event.original",  
"target\_field": "details",  
"if": "ctx?.trend\_micro\_vision\_one.detection.product.name == 'Vision One Container Security'"  
}  
This creates the field details.rawDataStr.  
I defined a custom mapping to define this field as Text.  
If I check the index mapping created after the rollover from Index Management \> Indices \> Index details \> Mappings, this field is actually text. However, in Discover, among the Available Fields, the field details.rawDataStr is keyword. Why? Thanks in advance for your answers.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 15, 2024, 1:40am UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983/2 "2024-12-15T01:40:58Z")

</div>

> [@Cristina\_Marletta\_Li](#):
>
> If I check the index mapping created after the rollover from Index Management \> Indices \> Index details \> Mappings, this field is actually text. However, in Discover, among the Available Fields, the field details.rawDataStr is keyword. Why? Thanks in advance for your answers.

Hi @Cristina_Marletta_Li

What version are you on.

Run on what the new index (post rollover) and old pre-rollover

```auto
GET .ds-logs-trend_micro_vision_one.detection-default-2024.12.15-000001/_mapping/field/details.rawDataStr

```

BUT if an old index is defined one type and new defined new type there is a conflict and I an not sure which way Discover will show...

---

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [December 15, 2024, 11:11am UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983/3 "2024-12-15T11:11:04Z")

</div>

Hi @stephenb ,  
the version is: v 8.16.1.  
the context is what you say. The details.rawDataSt field was keyword. I later changed it to text and did rollover.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 15, 2024, 2:23pm UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983/4 "2024-12-15T14:23:49Z")

</div>

Right so Discover will not necessarily show your new mapping when there are 2 different types in the Data view ..

If you run the command above and check the mapping and it's correct.... Then it's correct... When there are no more indices with the old mapping and you refresh the browser (because the mappings a cached locally) it should be correct