# How to update field to "keyword" using Logstash

**URL:** <https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466>\
**Category:** Logstash\
**Created:** [March 5, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466 "2018-03-05T09:16:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![emma](https://avatars.discourse-cdn.com/v4/letter/e/57b2e6/32.png) [@emma](https://discuss.elastic.co/u/emma)\
**Post date:** [March 5, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466/1 "2018-03-05T09:16:17Z")

</div>

I am new to ElasticSearch and Logstash

i have a DB with tables, I exported them to CSVs then imported to ElasticSearch using Logstash  
sample:  
{  
input {  
file {  
path =\> "C:\logstash-6.2.2\bin\profile.csv"  
start\_position =\> "beginning"  
}  
}  
filter {  
csv {  
separator =\> ","  
#"country","user","user\_id","birth\_date","profile","age"  
columns =\> ["country","user","user\_id","birth\_date","profile","age"]  
skip\_header =\> true  
}

```
	mutate
	{
		remove_field => ["message"]
		remove_field => ["path"]
		remove_field => ["host"]
	}
}
output {
   elasticsearch {
     hosts => "http://127.0.0.1:9200"
     index => "user_profile"
	 doc_as_upsert => true
	 document_id => "%{country}_%{user}"
}

stdout {}
}

```

}

then i started query on it using simple query:

{  
"query": {  
"term": {  
"country": "HK"  
}  
},  
"sort": [  
{  
"name": {  
"order": "asc"  
}  
}  
]  
}

but it returns: Fielddata is disabled on text fields by default.

i read some doc, and find that we need to set fields to "keyword"  
but how can we do it using Logstash?

thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-to-update-field-to-keyword-using-logstash/122466/2 "2018-04-02T09:16:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.