# Field stored as "text" though it was mapped to "keyword"

**URL:** <https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173>\
**Category:** Elasticsearch\
**Created:** [August 1, 2024, 1:31am UTC](https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173 "2024-08-01T01:31:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Post date:** [August 1, 2024, 1:31am UTC](https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173/1 "2024-08-01T01:31:54Z")

</div>

Hi,

I'm running Elasticsearch version 8.8.0, and I want to map `source.as.organization.name` and `destination.as.organization.name` as `keyword` fields. This is data sent to ES using Filebeat, that is automatically getting IP geoloc enriched.

The relevant portion of my index mapping is as follows.

```auto
"source": {
  "type": "object",
  "properties": {
    "as": {
      "type": "object",
      "properties": {
        "number": {
          "type": "integer"
        },
        "organization": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        }
      }
    },
    ...
"destination": {
  "type": "object",
  "properties": {
    "as": {
      "type": "object",
      "properties": {
        "number": {
          "type": "integer"
        },
        "organization": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        }
      }
    },
...

```

When I check the "Index Templates" page on Kibana, the mapping for both fields are displayed as `Keyword`. When I get the mapping of the current index via `GET <index_name>/_mapping`, I can see the exact configuration I set in the index template, i.e. `keyword` for both fields.

However, when I looked at the records on Discover, both fields are still displayed with the `t` icon next to it, indicating they are text fields. And this only just happened this morning (not yesterday when I modified the mapping), there is now a `multi-field` icon displayed on the Discover page for both `as.organization.name` fields. I don't think my configuration was making this field a `multi-field` ?

Why are the fields still stored as `text` fields, and how can I store them as `keyword` fields instead?

Thank you.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 1, 2024, 5:06am UTC](https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173/2 "2024-08-01T05:06:54Z")

</div>

Is your data being stored in an Index or a Data-Stream?

---

<div class="post-metadata">

**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Post date:** [August 1, 2024, 5:37am UTC](https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173/3 "2024-08-01T05:37:29Z")

</div>

It's a data stream. Basically it's what Filebeat automatically created in ES. And the index template is set to "Yes" for "Data stream".

BTW, when I looked at Index Management -\> Data Views on Kibana, I see both fields with the "Type" displayed as `text, keyword` . When I clicked the pencil icon, I see the greyed-out "Type" dropdown box as 'text'. Is this why the field is still showing up as `text` ?

Also, the index template is matching indices created before and after the change of mapping of the fields from `text` to `keyword`. My question is more of why the newest fields are not shown as `keyword` fields, as there is still the `t` icon (and `multi-field` shown next to the field name, even though they are mapped to `keyword`.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 2, 2024, 6:16am UTC](https://discuss.elastic.co/t/field-stored-as-text-though-it-was-mapped-to-keyword/364173/4 "2024-08-02T06:16:26Z")

</div>

I assume that the older backing indices of the data stream were text, and the newer indices and keyword.

Kibana recognises that the same field has multiple types across different indices and displays it as such.