# How to Turn OFF analyzed for one field in the logstash-\* index

**URL:** <https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155>\
**Category:** Kibana\
**Created:** [June 8, 2016, 6:18am UTC](https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155 "2016-06-08T06:18:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dkspace](https://avatars.discourse-cdn.com/v4/letter/d/bc79bd/32.png) [@dkspace](https://discuss.elastic.co/u/dkspace)\
**Post date:** [June 8, 2016, 6:18am UTC](https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155/1 "2016-06-08T06:18:07Z")

</div>

Dear colleagues.  
i have Kibana Elasticsearch fluentd.  
i import data via syslog (logstash format) and i see all new fields have option analysed On.  
But i not need it : top 10 and etc diagram is going by separated words from this fields.  
I need to top 10 for full original data in field.  
i tried to setup template  
PUT /\_template/logstash-\*  
{  
"template": "logstash-_",  
......  
"ProbableCause": { "type": "string", "index": "not\_analyzed" },  
....  
but result same .  
Could you help me to change analysed to not\_analysed for one field or for logstash-_ index  
?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 8, 2016, 8:10pm UTC](https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155/2 "2016-06-08T20:10:23Z")

</div>

It looks like you are getting an error when you are trying to set a mapping template. Can you provide the full command you are passing to Elasticsearch, and the full error message?

Also note that in Logstash 1.3.1 and above, there is a logstash indexing template provided which adds a `.raw` field to every field you index, which is mapped as `not_analyzed` and is the original value as-is. So you might not need to adjust the mappings at all - just use the original field when you want an analyzed string, and the `.raw` of that field when you want the `not_analyzed` original value.

---

<div class="post-metadata">

**Author:** ![dkspace](https://avatars.discourse-cdn.com/v4/letter/d/bc79bd/32.png) [@dkspace](https://discuss.elastic.co/u/dkspace)\
**Post date:** [June 27, 2016, 10:42am UTC](https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155/3 "2016-06-27T10:42:12Z")

</div>

Thank you! solved. by adding a .raw field to every field you index

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/how-to-turn-off-analyzed-for-one-field-in-the-logstash-index/52155/4 "2017-07-06T13:49:07Z")

</div>