# Get rid of .keyword
**URL:** https://discuss.elastic.co/t/get-rid-of-keyword/277105
**Category:** Logstash
**Created:** [June 25, 2021, 9:28pm UTC](https://discuss.elastic.co/t/get-rid-of-keyword/277105 "2021-06-25T21:28:59Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@svenvg93](https://discuss.elastic.co/u/svenvg93)
#### Post date: [June 25, 2021, 9:28pm UTC](https://discuss.elastic.co/t/get-rid-of-keyword/277105/1 "2021-06-25T21:28:59Z")
Hi,
I'm still a ELK noob so bear with me here ;).
I've setup Logstash to send the output of fping command to Elasticsearch and add some geoip data to it.
Fping output;
```auto
ec2.eu-west-1.amazonaws.com : xmt/rcv/%loss = 30/29/3%, min/avg/max = 27.1/27.4/28.0
```
I already remove some unwanted fields and converted some values. The thing I cannot seems to figure out is why I get same double fields of which one is name _fields_.keyword
```auto
@timestamp:
Jun 25, 2021 @ 23:18:35.680
@version:
1
avg:
89.5
geoip.as_org:
Amazon.com, Inc.
geoip.as_org.keyword:
Amazon.com, Inc.
geoip.asn:
16,509
geoip.country_code2:
US
geoip.country_code2.keyword:
US
geoip.country_name:
United States
geoip.country_name.keyword:
United States
geoip.ip:
54.239.28.168
loss:
0
max:
90.9
min:
89
tags:
fping
tags.keyword:
fping
target:
ec2.us-east-1.amazonaws.com
target.keyword:
ec2.us-east-1.amazonaws.com
type:
fping
type.keyword:
fping
_id:
wScJRXoBnY3E-uxC7RYW
_index:
logstash-2021.06.25-000001
_score:
-
_type:
_doc
```
How can I remove the .keyword fields since they are double.
full Logstash config;
```auto
input {
exec {
command => "/usr/bin/fping -q -c 30 -B1 -r1 < /etc/logstash/fping.conf 2>&1"
interval => 10
type => "fping"
tags => ["fping"]
}
}
filter {
if "fping" in [tags] {
split {
}
grok {
match => { "message" => "%{IPORHOST:target}.*loss = %{DATA}\/%{DATA}\/%{NUMBER:loss}%{DATA}= %{NUMBER:min}\/%{NUMBER:avg}\/%{NUMBER:max}" }
}
if [reponse] == "-" {
drop { }
} else {
mutate {
convert => { "avg" => "float" }
convert => { "loss" => "float" }
convert => { "max" => "float" }
convert => { "min" => "float" }
remove_field => "[command]"
remove_field => "[message]"
remove_field => "[host]"
}
}
geoip {
source => "target"
database => "usr/share/elasticsearch/modules/ingest-geoip/GeoLite2-Country.mmdb"
remove_field => "[geoip][continent_name]"
}
geoip {
source => "target"
database => "usr/share/elasticsearch/modules/ingest-geoip/GeoLite2-ASN.mmdb"
remove_field => "[geoip][as_org][keyword]"
}
}
}
output {
elasticsearch {
hosts => ["localhost"]
index => "fping-%{+YYYY.MM.dd}"
}
}
```
Any feedback on it is appreciated 🙂
Thnx!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 25, 2021, 9:36pm UTC](https://discuss.elastic.co/t/get-rid-of-keyword/277105/2 "2021-06-25T21:36:00Z")
The rationale for .keyword is explained in [this](https://www.elastic.co/blog/strings-are-dead-long-live-strings) blog post. Once you understand why they exist, if you want to stop them being created by default you will have to create your own template to replace the [default](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/templates/ecs-disabled/elasticsearch-7x.json).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 23, 2021, 9:36pm UTC](https://discuss.elastic.co/t/get-rid-of-keyword/277105/3 "2021-07-23T21:36:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.