# Field\_name.keyword appended to fields after upgrading to 6.5.x **URL:** \ **Category:** Elasticsearch\ **Created:** [December 18, 2018, 7:49am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264 "2018-12-18T07:49:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![popa](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@popa](https://discuss.elastic.co/u/popa)\ **Post date:** [December 18, 2018, 7:49am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/1 "2018-12-18T07:49:15Z")
I've noticed that most (if not all) of my `field_names` have a `.keyword` appended to them after upgrading my Elastic Stack from 6.4.x to 6.5.x. One thing that I've noticed is that when doing a unique count of a particular field, such as `computer_name`, some shards will fail and I will not get any results. However, when I use `computer_name.keyword`, I receive the desired results. I'm wondering if this is normal behavior or not? I'll also note that I did not reload in the new index mapping over 6.4.x's mapping, so perhaps that's the issue? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 18, 2018, 8:03am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/2 "2018-12-18T08:03:42Z")
It's the normal behavior since elasticsearch 6.0 (May be 5.0 as well.) when using the default dynamic mapping. ---
**Author:** ![popa](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@popa](https://discuss.elastic.co/u/popa)\ **Post date:** [December 18, 2018, 8:09am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/3 "2018-12-18T08:09:11Z")
Got ya, and thanks for the quick reply. So basically any field that is dynamically populated (not hard coded in the index mapping) will have the `.keyword` appended it during upgrades? When I go from 6.5.x to 6.6.x, will that create a `field_name.keyword.keyword`? If so, I should probably start by creating a map for each field that's going to be in my indices. 🤯 ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 18, 2018, 8:23am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/4 "2018-12-18T08:23:15Z")
Upgrades don't do that. It's just happening to new fields. If by upgrade, you meant reindex then that can happen indeed. I'm not sure about what you did though. ---
**Author:** ![popa](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@popa](https://discuss.elastic.co/u/popa)\ **Post date:** [December 18, 2018, 8:29am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/5 "2018-12-18T08:29:01Z")
Nope, I didn't mean reindex. I just did a normal rolling upgrade from 6.4.x to 6.5.x. However, I think that's something I'll likely have to end up doing here in the next few days. Everything is fairly vanilla in my environment -- using Winlogbeat to collect events, feeding that into Logstash, and then indexing everything Logstash outputs to Elasticsearch. Thanks for lending your knowledge! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 18, 2018, 8:56am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/6 "2018-12-18T08:56:54Z")
> I just did a normal rolling upgrade from 6.4.x to 6.5.x. This should not happen on existing indices. May be you didn't notice the fields earlier? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2019, 8:56am UTC](https://discuss.elastic.co/t/field-name-keyword-appended-to-fields-after-upgrading-to-6-5-x/161264/7 "2019-01-15T08:56:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.