# Fields Mapping | not\_analyzed
**URL:** https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940
**Category:** Elasticsearch
**Created:** [August 1, 2016, 11:03pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940 "2016-08-01T23:03:41Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@dneto](https://discuss.elastic.co/u/dneto)
#### Post date: [August 1, 2016, 11:03pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/1 "2016-08-01T23:03:42Z")
Hi Friends,
I'm starting using the ELK Stack to create a sort of Log Archiving and Log Analyses tool to my team.
I have some firewalls and need change some fields to not\_analyzed.
I don't know why, but when I load Kibana, all my fields seems as Analyzed. What is the right manner to apply fields mapping templates?
Thanks in advance for the help.
Here is my conf of Logstash:
`.... output { if [type] == "netscreen_traffic" { elasticsearch { hosts => ["localhost:9200"] index => "firewall-traffic-%{+YYYY.MM.DD}" manage_template => false template_overwrite => true template_name => "firewall-traffic" #template => "/etc/logstash/templates/firewall-traffic.json" } }`
Here is my mapping json:
`{ "template" : "firewall-traffic", "mappings": { "netscreen_traffic": { "action": { "type": "string" }, "device": { "type": "string", "index": "not_analyzed" }, "device_id": { "type": "string", "index": "not_analyzed" }, "dst_ip": { "type": "ip" }, "dst_port": { "type": "string" }, "dst_xlated_ip": { "type": "ip" }, "dst_xlated_port": { "type": "string" }, "dst_zone": { "type": "string", "index": "not_analyzed" }, "duration": { "type": "string" }, "host": { "type": "string", "index": "not_analyzed" }, "message": { "type": "string" }, "policy_id": { "type": "string" }, "priority": { "type": "string" }, "proto": { "type": "string" }, "rcvd": { "type": "integer" }, "reason": { "type": "string", "index": "not_analyzed" }, "sent": { "type": "integer" }, "service": { "type": "string" }, "session_id": { "type": "string" }, "src_ip": { "type": "ip" }, "src_port": { "type": "string" }, "src_xlated_ip": { "type": "ip" }, "src_xlated_port": { "type": "string" }, "src_zone": { "type": "string", "index": "not_analyzed" }, "start_time": { "type": "date" }, "syslog5424_pri": { "type": "string" }, "tags": { "type": "string" }, "type": { "type": "string" } } } }`
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2016, 10:30am UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/2 "2016-08-02T10:30:17Z")
> [@dneto](#):
>
> I don't know why, but when I load Kibana, all my fields seems as Analyzed.
Which fields are you trying to set as not analysed?
---
### Author:  [@dneto](https://discuss.elastic.co/u/dneto)
#### Post date: [August 2, 2016, 1:49pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/3 "2016-08-02T13:49:58Z")
Hi @warkolm, thanks for you awnser, these are the fields what I need don't be analyzed.
These fileds are defined in a custom pattern file, by grok filter.
> [@dneto](#):
>
> "device": { "type": "string", "index": "not\_analyzed" },
> [@dneto](#):
>
> "device\_id": { "type": "string", "index": "not\_analyzed" },
> [@dneto](#):
>
> "dst\_zone": { "type": "string", "index": "not\_analyzed" },
> [@dneto](#):
>
> "host": { "type": "string", "index": "not\_analyzed" },
> [@dneto](#):
>
> "reason": { "type": "string", "index": "not\_analyzed" },
> [@dneto](#):
>
> "src\_zone": { "type": "string", "index": "not\_analyzed" },
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2016, 9:09pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/4 "2016-08-02T21:09:51Z")
Ok, just making sure ๐
Have you refreshed the index pattern in KB settings?
Has the template been properly applied to the index it is creating?
---
### Author:  [@dneto](https://discuss.elastic.co/u/dneto)
#### Post date: [August 3, 2016, 9:09pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/5 "2016-08-03T21:09:15Z")
HI @warkolm,
I wrote everything from scratch. I get the default template to compare with mine and now I have generated this bellow.
I wasn't use properly the **Properties** before. ๐
Now I rewrite, submit and applied with success the template to ElasticSearch .
Thanks in advance for you help and sorry my badly english.
`{ "template": "firewall-cleanup-*", "settings": { "index.refresh_interval": "10s" }, "mappings": { "netscreen_traffic": { "properties": { "@timestamp": { "type": "date", "format": "strict_date_optional_time||epoch_millis" }, "@version": { "type": "string" }, "action": { "type": "string" }, "device": { "type": "string", "index": "not_analyzed" }, "device_id": { "type": "string", "index": "not_analyzed" }, "dst_ip": { "type": "ip" }, "dst_port": { "type": "string" }, "dst_xlated_ip": { "type": "ip" }, "dst_xlated_port": { "type": "string" }, "dst_zone": { "type": "string", "index": "not_analyzed" }, "duration": { "type": "string" }, "host": { "type": "string", "index": "not_analyzed" }, "message": { "type": "string" }, "policy_id": { "type": "string" }, "priority": { "type": "string" }, "proto": { "type": "string" }, "rcvd": { "type": "string" }, "reason": { "type": "string", "index": "not_analyzed" }, "sent": { "type": "string" }, "service": { "type": "string" }, "session_id": { "type": "string" }, "src_ip": { "type": "ip" }, "src_port": { "type": "string" }, "src_xlated_ip": { "type": "ip" }, "src_xlated_port": { "type": "string" }, "src_zone": { "type": "string", "index": "not_analyzed" }, "start_time": { "type": "string" }, "syslog5424_pri": { "type": "string" }, "tags": { "type": "string" }, "type": { "type": "string" } } } } }`
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 4, 2016, 12:05am UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/6 "2016-08-04T00:05:39Z")
And do the `_types` of the documents you are indexing match the index?
---
### Author:  [@dneto](https://discuss.elastic.co/u/dneto)
#### Post date: [August 8, 2016, 7:13pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/7 "2016-08-08T19:13:10Z")
Hi @warkolm,
Thank you for you assistance. Now Its working well. ๐
Now my challenge is match other firewall model, based in JUNOS OS. Iยดll open new topic to keep clean.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:29pm UTC](https://discuss.elastic.co/t/fields-mapping-not-analyzed/56940/8 "2017-07-05T22:29:18Z")