# ECS recommended data types **URL:** \ **Category:** Elasticsearch\ **Created:** [July 27, 2021, 8:53am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707 "2021-07-27T08:53:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Post date:** [July 27, 2021, 8:53am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/1 "2021-07-27T08:53:45Z")
Hi, What will be the impact if i change the ECS recommended data type for ECS fields. For example what if i map the event.action field as 'text' datatype instead of keyword. I am receiving the following values in event action. values: PRofile created, profile CREATED, Profile CreateD etc. I want to query/search this event.action field as case insensitive. so i want to change the data type from ecs recommended keyword to text type to do analyzed search. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [July 27, 2021, 9:05am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/2 "2021-07-27T09:05:52Z")
In this concrete example you will need more space and you will not be able to run aggregations when using `text` as a field type. As a general rule of thumb, I would try to leave the fields as is (always keep in mind the person coming after 🙂), but you are free to add more fields and just copy the value from one field to another. Two possible solutions here. First use copy\_to in the mapping, see [copy\_to | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/copy-to.html) Second, use a processor within your ingest pipeline, see [Set processor | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/set-processor.html) ---
**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Post date:** [July 28, 2021, 5:35am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/3 "2021-07-28T05:35:06Z")
Thank you #spinscale for your reply. But my doubt here is, ECS is not recommending any text data type. ECS recommends to maintain all fields in keyword. So when i copy\_to a new field with text data type, will this impact the SIEM Security detection or any other areas? I understand the two issues mentioned above ie. more space consuming and aggregation will not work with text data type fields. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 28, 2021, 6:13am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/4 "2021-07-28T06:13:50Z")
You could perhaps copy\_to a new keyword field with [a lowercase normalizer](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/normalizer.html) if you do not want to alter your data through a pipeline. This will index the keyword in lowercased form and provide case insenitivity. ---
**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Post date:** [July 28, 2021, 6:49am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/5 "2021-07-28T06:49:22Z")
Thank you #Christian\_Dahlqvist for your reply. For a conclusion, Is this ECS not allowing to maintain a single field with data type other than keyword ? Here I am trying to understand the best practice of using ECS. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2021, 6:50am UTC](https://discuss.elastic.co/t/ecs-recommended-data-types/279707/6 "2021-08-25T06:50:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.