# How can I updated the a sub-field within an index to be not\_analyzed?

**URL:** <https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939>\
**Category:** Kibana\
**Created:** [October 25, 2016, 9:54pm UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939 "2016-10-25T21:54:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kpam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kpam/32/12447_2.png) [@kpam](https://discuss.elastic.co/u/kpam)\
**Post date:** [October 25, 2016, 9:54pm UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939/1 "2016-10-25T21:54:08Z")

</div>

I have an index with a sub-filed that I want to set to be not analyzed? How can I change this?

Additionally, this indexes are patterned for the day using Filebeat -- is there a way to ensure when new indices are created by Filebeat, the same not analyzed configuration takes place?

Here is my index myrecords-YYYY-MM-DD:

```
{
	"myrecords-2016.10.25": {
		"aliases": {},
		"mappings": {
			"log": {
				"properties": {
					"@timestamp": {
					"type": "date",
						"format": "dateOptionalTime"
					},
					"user_info": {
						"properties": {
							"channel": {
								"type": "string"
							},
							"channel_params": {
								"properties": {
									"b_length": {
										"type": "long"
									},
									"current_view": {
										"type": "string"
									},
									"m_status": {
										"type": "boolean"
									},
									"is_official": {
										"type": "boolean"
									}
								}
							},
							"viewer": {
								"properties": {
									"platform": {
										"type": "string"
									},
									"player": {
										"type": "string"
									}
								}
							}
						}
					},
					"response": {
						"type": "string"
					}
				}
			}
		},
		"settings": {
			"index": {
				"creation_date": "1477353651509",
				"number_of_shards": "5",
				"number_of_replicas": "1",
				"version": {
					"created": "1050299"
				},
				"uuid": "OmI6yE8CQJS-wqVIfHsbig"
			}
		},
		"warmers": {}
	}
}

```

I want to change `current_view` to be not\_analyzed and I want the change to take place for every new index created by filebeat when shipping logs to ES.

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [October 25, 2016, 10:53pm UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939/2 "2016-10-25T22:53:14Z")

</div>

You're looking for index templates.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html)

Index templates are configurations that you save in elasticsearch that get applied whenever a new index is created, as long as the index name matches the templates

Your index template should probably looks something like this:

```auto
{
  "template": "myrecords-*",
  "mappings": {
    "log": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "dateOptionalTime"
        },
        "myfield": {
          "type": "string",
          "fields": {
            "raw": { 
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![kpam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kpam/32/12447_2.png) [@kpam](https://discuss.elastic.co/u/kpam)\
**Post date:** [October 26, 2016, 12:03am UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939/3 "2016-10-26T00:03:00Z")

</div>

Thanks @spalger -- will this work with the particular field I want since it's quite nested?

I want to change the `current_view` field which is nested within `channel_params` which is nested in `user_info`.

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [October 27, 2016, 4:11pm UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939/4 "2016-10-27T16:11:08Z")

</div>

Sure will!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:35pm UTC](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939/5 "2017-07-06T13:35:27Z")

</div>