# Domain name in hostname is treated as separate field

**URL:** <https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444>\
**Category:** Kibana\
**Created:** [August 15, 2015, 8:26pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444 "2015-08-15T20:26:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![szemlyanoy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/szemlyanoy/32/22173_2.png) [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\
**Post date:** [August 15, 2015, 8:26pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/1 "2015-08-15T20:26:17Z")

</div>

Hi,

I'm in position of migrating from former ELK stack to the latest one  
So I have 2 environments:  
Redis -\> Logstash(v1.4.2) -\> ES(v1.4.2) -\> Kibana(v3.1.0)  
Redis -\> Logstash(v1.5.2) -\> ES(v1.7.1) -\> Kibana(v4.0.2)

So I have both ES instances with the duplicate indexes. Now is experimenting with charts.  
Problem:  
When I create piechart with Term 'host.raw'(and with 'host' also) it shows all hosts plus domain name as separate field. Please note that it is showing properly in Kibana3.

What am I doing wrong?

Thanks ahead  
Sergey

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 15, 2015, 10:01pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/2 "2015-08-15T22:01:15Z")

</div>

It shouldn't be doing that on the .raw field.  
It might help if you show us the mapping for the index.

---

<div class="post-metadata">

**Author:** ![szemlyanoy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/szemlyanoy/32/22173_2.png) [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\
**Post date:** [August 16, 2015, 9:07am UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/3 "2015-08-16T09:07:38Z")

</div>

Hi Mark,

Let me clarify my issue, narrowed today and what I found - it seems that any type .raw filed is not working. It just doesnt update pie chart when I select raw field at all. If I choose some raw field initially when creating pie chart, it shows \_all message and seems sum up all documents.  
Below is cut of index mapping(it's quite big so I paste only one type, rest are the same):

curl -XGET localhost:9200/logstash-2015.08.15/\_mapping?pretty  
{  
"logstash-2015.08.15" : {  
"mappings" : {  
"syslog-oom" : {  
"properties" : {  
"@timestamp" : {  
"type" : "date",  
"format" : "dateOptionalTime"  
},  
"@version" : {  
"type" : "string"  
},  
"host" : {  
"type" : "string"  
},  
"info" : {  
"type" : "string"  
},  
"message" : {  
"type" : "string"  
},  
"path" : {  
"type" : "string"  
},  
"process" : {  
"type" : "string"  
},  
"source" : {  
"type" : "string"  
},  
"tags" : {  
"type" : "string"  
},  
"timestamp" : {  
"type" : "string"  
},  
"type" : {  
"type" : "string"  
}  
}  
},

Thanks  
Sergey

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 16, 2015, 9:29am UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/4 "2015-08-16T09:29:51Z")

</div>

According to your mappings you don't have any .raw fields so it's not surprising that they don't work. Are you defining your own index template? What's in it?

---

<div class="post-metadata">

**Author:** ![szemlyanoy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/szemlyanoy/32/22173_2.png) [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\
**Post date:** [August 16, 2015, 9:00pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/5 "2015-08-16T21:00:14Z")

</div>

User error!  
I missed my indexes' template! Now it's fixed

Thanks all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:14pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444/6 "2017-07-06T14:14:45Z")

</div>