# How to change the fields to 'not-analyzed'?

**URL:** <https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506>\
**Category:** Logstash\
**Created:** [April 27, 2016, 6:38am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506 "2016-04-27T06:38:43Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![PKA](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@PKA](https://discuss.elastic.co/u/PKA)\
**Post date:** [April 27, 2016, 6:38am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/1 "2016-04-27T06:38:43Z")

</div>

I am a newbie, pls help me with doing this.

In Kibana, all my strings are getting split on the blank space character, whenever I choose 'Terms' option. Reading some threads on forums I understood that we need to change the fields to 'not\_analyzed' in logstash. I am using logstash v2.3 and am unable to change to not\_analyzed. Pls help

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 27, 2016, 7:44am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/2 "2016-04-27T07:44:39Z")

</div>

You need to do that in ES via the mappings.

Look at the \_mappings API call.

---

<div class="post-metadata">

**Author:** ![PKA](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@PKA](https://discuss.elastic.co/u/PKA)\
**Post date:** [April 27, 2016, 8:26am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/3 "2016-04-27T08:26:04Z")

</div>

> [@warkolm](#):
>
> \_mappings

I checked that API. However, it suggests how to change a single field. What if I want to change the mapping of all the string fields so that none of them splits up?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 27, 2016, 8:52am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/4 "2016-04-27T08:52:29Z")

</div>

That's a more detailed thing.

You cannot change a field once it is in ES, you really need to define things _before_ you send to ES.  
If you don't want to split things up then look at analysis, essentially using `not_analyzed` on a field.

---

<div class="post-metadata">

**Author:** ![PKA](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@PKA](https://discuss.elastic.co/u/PKA)\
**Post date:** [April 27, 2016, 8:54am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/5 "2016-04-27T08:54:07Z")

</div>

> [@warkolm](#):
>
> You cannot change a field once it is in ES, you really need to define things before you send to ES.

Can you pls suggest how to do that? I am quite new to the ELK stack and not getting really how to do what you are suggesting

---

<div class="post-metadata">

**Author:** ![MrLee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrlee/32/9429_2.png) [@MrLee](https://discuss.elastic.co/u/MrLee)\
**Post date:** [April 27, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/6 "2016-04-27T09:23:22Z")

</div>

Maybe set a template in ES is helpful for you. [https://www.elastic.co/guide/en/elasticsearch/reference/current/default-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/default-mapping.html)

```auto
eg:
curl -XPUT 'localhost:9200/_template/all' -d '
{
        "order": 0,
        "template": "*",
        "settings": {
            "index.number_of_shards": "1"
        },
        "mappings": {
            "_default_": {
                "dynamic_templates": [
                    {
                        "string": {
                            "mapping": {
                                "index": "not_analyzed",
                                "type": "string"
                            },
                            "match_mapping_type": "string"
                        }
                    }
                ]
            }
        },
        "aliases": {}
    }
}
'

```

It will set all the string type field not\_analyzed.

---

<div class="post-metadata">

**Author:** ![PKA](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@PKA](https://discuss.elastic.co/u/PKA)\
**Post date:** [April 27, 2016, 10:05am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/7 "2016-04-27T10:05:36Z")

</div>

> [@MrLee](#):
>
> curl -XPUT 'localhost:9200/\_template/all' -d '  
> {  
> "order": 0,  
> "template": "\*",  
> "settings": {  
> "index.number\_of\_shards": "1"  
> },  
> "mappings": {  
> "_default_": {  
> "dynamic\_templates": [  
> {  
> "string": {  
> "mapping": {  
> "index": "not\_analyzed",  
> "type": "string"  
> },  
> "match\_mapping\_type": "string"  
> }  
> }  
> ]  
> }  
> },  
> "aliases": {}  
> }  
> }  
> '

Yes, thanks..  
Actually I needed these for my logstash indexes. Just realised that if i changed the index names to logstash-\*, then every field has a non-analyzed version also getting created. it has a .raw suffix. I guess with this change , I do not really need to make changes to ES..Thanks for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/how-to-change-the-fields-to-not-analyzed/48506/8 "2017-07-06T05:00:21Z")

</div>