# GROK query generating .keyword fields in Elasticsearch
**URL:** https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152
**Category:** Logstash
**Created:** [April 3, 2021, 2:16pm UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152 "2021-04-03T14:16:45Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@finbarr996](https://discuss.elastic.co/u/finbarr996)
#### Post date: [April 3, 2021, 2:16pm UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152/1 "2021-04-03T14:16:45Z")
Hi there,
I'm happily parsing a bunch of syslog files in Logstash, but notice that an entry like `%{DATA:Something}` creates a `Something` field and additionally a `Something.keyword` field in Elasticsearch.
Is there a way to suppress the generation of this additional `Something.keyword` field and it's duplicate data?
Thank you!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 3, 2021, 3:03pm UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152/2 "2021-04-03T15:03:42Z")
This is really an elasticsearch question. The [default template](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/9401759a165f51e4b10dd195b1394760dc70dd92/lib/logstash/outputs/elasticsearch/templates/ecs-disabled/elasticsearch-7x.json#L19) creates a keyword for every text field. [This](https://www.elastic.co/blog/strings-are-dead-long-live-strings) blog post provides background on why. You will need to supply a different template.
---
### Author:  [@finbarr996](https://discuss.elastic.co/u/finbarr996)
#### Post date: [April 5, 2021, 10:24am UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152/3 "2021-04-05T10:24:57Z")
Thank you - that's really helpful.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 3, 2021, 10:25am UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152/4 "2021-05-03T10:25:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.