# Duplicate field mapping in kibana with ".keyword" at the end

**URL:** <https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830>\
**Category:** Kibana\
**Created:** [October 23, 2019, 9:46am UTC](https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830 "2019-10-23T09:46:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [October 23, 2019, 9:46am UTC](https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830/1 "2019-10-23T09:46:42Z")

</div>

i have setup EFK stack in k8 cluster, created the index pattern, it crated an extra field with ".keyword" at the end, this field has aggregateable option enabled.

1. why are there 2 same field mappings, one is aggregateable but the other one isn't?
2. cant the original filed have the aggregateable option enabled?

here is a screenshot of what I am seeing:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34349ccdf5d6f699e70f610d7bc3a80e22ed2f40.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [October 23, 2019, 1:42pm UTC](https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830/2 "2019-10-23T13:42:55Z")

</div>

The difference between these fields is how they are indexed - the regular one is indexed as text, which means you can do a full text search on it (suitable for fields that contain lots of text, e.g. an article or a description of a product). The other one is indexed as keyword which means you can only search for the whole value of the field, not individual parts of it (suitable for fields with short values, like a transaction type or an id). This is the blog post explaining it in greater detail: [https://www.elastic.co/blog/strings-are-dead-long-live-strings](https://www.elastic.co/blog/strings-are-dead-long-live-strings)

The keyword field is aggregateable which means you can do things like terms aggregations on it.

If you only want to filter by the whole value of a field and do aggregations on it, you don't need the "text" indexed version of it. Having both fields is just the default mapping, you can specify an explicit mapping to just index the fields as keyword under the original field name: [https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#create-mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#create-mapping)

For more complex cases it might make sense to look into dynamic templates: [https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html#dynamic-templates](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html#dynamic-templates)

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [October 23, 2019, 2:47pm UTC](https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830/3 "2019-10-23T14:47:25Z")

</div>

great explanation, thx!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2019, 2:47pm UTC](https://discuss.elastic.co/t/duplicate-field-mapping-in-kibana-with-keyword-at-the-end/204830/4 "2019-11-20T14:47:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.