# Dynamic template with logstash question

**URL:** <https://discuss.elastic.co/t/dynamic-template-with-logstash-question/115766>\
**Category:** Logstash\
**Created:** [January 16, 2018, 5:30pm UTC](https://discuss.elastic.co/t/dynamic-template-with-logstash-question/115766 "2018-01-16T17:30:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [January 16, 2018, 5:30pm UTC](https://discuss.elastic.co/t/dynamic-template-with-logstash-question/115766/1 "2018-01-16T17:30:37Z")

</div>

Hi guyes, im having some issues with my template and I wanted to clear up if im using the path\_unmatch correctly.

Im using the default logstash index template with one change.  
The keyword match "\*" now has a path\_unmatch as so

```
    "string_fields" : {
      "match" : "*",
      "path_unmatch" : "webapp.*",
      "match_mapping_type" : "string",
      "mapping" : {
        "type" : "text", "norms" : false,
        "fields" : {
          "keyword" : { "type": "keyword", "ignore_above": 256 }
        }
      }

```

I have KV filter which parses URI params into the target folder "webapp" however I dont want to have these field indexed as both analysed and keyword as it quickly adds up to field exhaustion , However when this used i still get

webapp.field and  
webapp.field.keyword

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 5:30pm UTC](https://discuss.elastic.co/t/dynamic-template-with-logstash-question/115766/2 "2018-02-13T17:30:51Z")

</div>

Closed on February 13, 2018, 5:30pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.