# Default some fields to not\_analyzed - Having problems

**URL:** <https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374>\
**Category:** Elasticsearch\
**Created:** [August 28, 2013, 5:54pm UTC](https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374 "2013-08-28T17:54:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ralph\_Trickey\_2](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ralph\_Trickey\_2](https://discuss.elastic.co/u/Ralph_Trickey_2)\
**Post date:** [August 28, 2013, 5:54pm UTC](https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374/1 "2013-08-28T17:54:16Z")

</div>

I've got the following file in the config/templates directory. I know it's  
being parsed, but it doesn't seem to have any effect on the field  
definitions. I can tell from the mappings that something is happening, but  
it's not what I want ☹ I'm not seeing any entries in the log file  
indicating any issues.

{  
"template\_logstash" : {  
"template": "logstash-_",  
"order": 1,  
"mappings" : {  
"raw" : {  
"dynamic\_templates" : [  
{  
template\_3 : {  
"match" : "_\_RAW",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"type" : "string",  
"index" : "not\_analyzed"  
}  
}  
}  
]  
}  
}  
}  
}

Test (should return ONE(1) row) actually returns about 7 so the  
not\_analyzed isn't working.

{  
"query": {  
"match\_all": {}  
},  
"facets": {  
"TermResults": {  
"terms": {  
"fields": [  
"AppDetails:Version\_RAW"  
],  
"size": 10  
}  
}  
},  
"size": 0  
}  
Metadata (partial)

{  
state: open  
settings: {  
index.number\_of\_shards: 5  
index.number\_of\_replicas: 1  
index.version.created: 200699  
}  
mappings: {  
raw: {  
dynamic\_templates: [  
{  
template\_3: {  
mapping: {  
index: not\_analyzed  
type: string  
}  
match\_mapping\_type: string  
match: \*  
}  
}  
]  
properties: { }  
}  
hll: {  
properties: {  
@fields: {  
dynamic: true  
properties: {  
ErrorLevel: {  
type: string  
}  
EventDetails:DNIS: {  
type: string  
}  
ElementType: {  
type: string  
}  
AppDetails:Version\_RAW: {  
type: string  
}  
}  
@timestamp: {  
format: dateOptionalTime  
type: date  
}  
@message: {  
type: string  
}  
@source: {  
type: string  
}  
@type: {  
type: string  
}  
@source\_host: {  
type: string  
}  
@source\_path: {  
type: string  
}  
}  
}  
}  
aliases: []  
}

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Ralph\_Trickey\_2](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ralph\_Trickey\_2](https://discuss.elastic.co/u/Ralph_Trickey_2)\
**Post date:** [August 29, 2013, 2:35pm UTC](https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374/2 "2013-08-29T14:35:35Z")

</div>

Anyone? I've been through everything I can think of and this should work.  
It shows up in the schema, which I assume is the correct behavior.

Thanks,  
Ralph

On Wednesday, August 28, 2013 11:54:16 AM UTC-6, Ralph Trickey wrote:

> I've got the following file in the config/templates directory. I know it's  
> being parsed, but it doesn't seem to have any effect on the field  
> definitions. I can tell from the mappings that something is happening, but  
> it's not what I want ☹ I'm not seeing any entries in the log file  
> indicating any issues.
> 
> {  
> "template\_logstash" : {  
> "template": "logstash-_",  
> "order": 1,  
> "mappings" : {  
> "raw" : {  
> "dynamic\_templates" : [  
> {  
> template\_3 : {  
> "match" : "_\_RAW",  
> "match\_mapping\_type" : "string",  
> "mapping" : {  
> "type" : "string",  
> "index" : "not\_analyzed"  
> }  
> }  
> }  
> ]  
> }  
> }  
> }  
> }
> 
> Test (should return ONE(1) row) actually returns about 7 so the  
> not\_analyzed isn't working.
> 
> {  
> "query": {  
> "match\_all": {}  
> },  
> "facets": {  
> "TermResults": {  
> "terms": {  
> "fields": [  
> "AppDetails:Version\_RAW"  
> ],  
> "size": 10  
> }  
> }  
> },  
> "size": 0  
> }  
> Metadata (partial)
> 
> {  
> state: open  
> settings: {  
> index.number\_of\_shards: 5  
> index.number\_of\_replicas: 1  
> index.version.created: 200699  
> }  
> mappings: {  
> raw: {  
> dynamic\_templates: [  
> {  
> template\_3: {  
> mapping: {  
> index: not\_analyzed  
> type: string  
> }  
> match\_mapping\_type: string  
> match: \*  
> }  
> }  
> ]  
> properties: { }  
> }  
> hll: {  
> properties: {  
> @fields: {  
> dynamic: true  
> properties: {  
> ErrorLevel: {  
> type: string  
> }  
> EventDetails:DNIS: {  
> type: string  
> }  
> ElementType: {  
> type: string  
> }  
> AppDetails:Version\_RAW: {  
> type: string  
> }  
> }  
> @timestamp: {  
> format: dateOptionalTime  
> type: date  
> }  
> @message: {  
> type: string  
> }  
> @source: {  
> type: string  
> }  
> @type: {  
> type: string  
> }  
> @source\_host: {  
> type: string  
> }  
> @source\_path: {  
> type: string  
> }  
> }  
> }  
> }  
> aliases:   
> }

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Ralph\_Trickey\_2](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ralph\_Trickey\_2](https://discuss.elastic.co/u/Ralph_Trickey_2)\
**Post date:** [August 29, 2013, 3:32pm UTC](https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374/3 "2013-08-29T15:32:22Z")

</div>

I figured it out I had to change  
"mappings" : {  
"raw" : {

to  
"mappings" : {  
"_default_" : {

On Wednesday, August 28, 2013 11:54:16 AM UTC-6, Ralph Trickey wrote:

> I've got the following file in the config/templates directory. I know it's  
> being parsed, but it doesn't seem to have any effect on the field  
> definitions. I can tell from the mappings that something is happening, but  
> it's not what I want ☹ I'm not seeing any entries in the log file  
> indicating any issues.
> 
> {  
> "template\_logstash" : {  
> "template": "logstash-_",  
> "order": 1,  
> "mappings" : {  
> "raw" : {  
> "dynamic\_templates" : [  
> {  
> template\_3 : {  
> "match" : "_\_RAW",  
> "match\_mapping\_type" : "string",  
> "mapping" : {  
> "type" : "string",  
> "index" : "not\_analyzed"  
> }  
> }  
> }  
> ]  
> }  
> }  
> }  
> }
> 
> Test (should return ONE(1) row) actually returns about 7 so the  
> not\_analyzed isn't working.
> 
> {  
> "query": {  
> "match\_all": {}  
> },  
> "facets": {  
> "TermResults": {  
> "terms": {  
> "fields": [  
> "AppDetails:Version\_RAW"  
> ],  
> "size": 10  
> }  
> }  
> },  
> "size": 0  
> }  
> Metadata (partial)
> 
> {  
> state: open  
> settings: {  
> index.number\_of\_shards: 5  
> index.number\_of\_replicas: 1  
> index.version.created: 200699  
> }  
> mappings: {  
> raw: {  
> dynamic\_templates: [  
> {  
> template\_3: {  
> mapping: {  
> index: not\_analyzed  
> type: string  
> }  
> match\_mapping\_type: string  
> match: \*  
> }  
> }  
> ]  
> properties: { }  
> }  
> hll: {  
> properties: {  
> @fields: {  
> dynamic: true  
> properties: {  
> ErrorLevel: {  
> type: string  
> }  
> EventDetails:DNIS: {  
> type: string  
> }  
> ElementType: {  
> type: string  
> }  
> AppDetails:Version\_RAW: {  
> type: string  
> }  
> }  
> @timestamp: {  
> format: dateOptionalTime  
> type: date  
> }  
> @message: {  
> type: string  
> }  
> @source: {  
> type: string  
> }  
> @type: {  
> type: string  
> }  
> @source\_host: {  
> type: string  
> }  
> @source\_path: {  
> type: string  
> }  
> }  
> }  
> }  
> aliases:   
> }

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:18am UTC](https://discuss.elastic.co/t/default-some-fields-to-not-analyzed-having-problems/13374/4 "2017-07-06T02:18:59Z")

</div>