# Grok - How do I make it so a field is indexed in ES?

**URL:** <https://discuss.elastic.co/t/grok-how-do-i-make-it-so-a-field-is-indexed-in-es/113238>\
**Category:** Logstash\
**Created:** [December 26, 2017, 5:44pm UTC](https://discuss.elastic.co/t/grok-how-do-i-make-it-so-a-field-is-indexed-in-es/113238 "2017-12-26T17:44:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\
**Post date:** [December 26, 2017, 5:44pm UTC](https://discuss.elastic.co/t/grok-how-do-i-make-it-so-a-field-is-indexed-in-es/113238/1 "2017-12-26T17:44:18Z")

</div>

First thing, I do have a Grok configuration file which is working just fine in parsing my log files. I even have it writing to a separate file for any non matches.

My issue is that when looking at the created index for logstash-\* it only ever contains the following fields (\_id, \_index, \_score, \_source and \_type)

How do I add fields to this through the config file?

What I have in my config file, which I thought would do the trick is...

add\_field =\> ["fieldOne", "valueOne",  
"fieldTwo", "valueTwo",  
"fieldThree", "valueThree",  
"fieldFour", "valueFour"  
]

What am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![E\_Marshall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e_marshall/32/14191_2.png) [@E\_Marshall](https://discuss.elastic.co/u/E_Marshall)\
**Post date:** [December 26, 2017, 7:07pm UTC](https://discuss.elastic.co/t/grok-how-do-i-make-it-so-a-field-is-indexed-in-es/113238/2 "2017-12-26T19:07:14Z")

</div>

Okay, partially figured out some things.  
The lead has everything going to a default template in order to force us to learn how to create our own templates. Good thinking 🙂  
So, the default template has for mapping the dynamic value set to false for creating the indexes I've been trying to get to work all day.  
So I'm off to go read up on creating Templates and Mappings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2018, 7:16pm UTC](https://discuss.elastic.co/t/grok-how-do-i-make-it-so-a-field-is-indexed-in-es/113238/3 "2018-01-23T19:16:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.