# I need to index my field as type=keyword as oppose to type=text **URL:** \ **Category:** Elasticsearch\ **Created:** [January 9, 2019, 11:53am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524 "2019-01-09T11:53:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![utki](https://avatars.discourse-cdn.com/v4/letter/u/c57346/32.png) [@utki](https://discuss.elastic.co/u/utki)\ **Post date:** [January 9, 2019, 11:53am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/1 "2019-01-09T11:53:51Z")
I need to index my field as `type=keyword` as oppose to `type=text`, since I need to create dashboard using the fields which are tagged as type text and I am not able to create one. Below is my config file: ``` input { file { path => "C:/Users/utkarsh.sanadhya/Desktop/elasticsearch_course/Data/logs/Sixteen.txt" type => "json" start_position => "beginning" } } filter { dissect { mapping => { "message" => "%{ts} %{+ts} %{+ts} %{a} %{b}: [%{level}][%{c}][%{d}@%{e}: %{msg}" } } json { source => "msg" } } output { stdout { codec => dots } elasticsearch { } } ``` Below is snippet of my log file: ``` Dec 26 00:32:50 ServerName mars-auth-capture: [INFO][mars][auth-capture]@cee: {"profile":"http://cee.mitre.org/1.0-beta1/coreprofile","host":"a.b.c.d","pname":"mars-auth-capture","native":{"request_timestamp":"12/26/18 00:20:46","request_protocol":"HTTP/1.1","request_method":"POST","request_url":"/cgi-bin/WebObjects/tsweb-marsweb.woa/6/wo/rdAc6opdpQoEmV4hnQogPM/2.19.1"," **request_header_x_forwarded_for**":"e.f.g.h","request_username":"username","response_header_set_cookie":"rdAc6opdpQoEmV4hnQogPM","response_auth_result":"error occurred"}} ``` I need to create dashboard using fields request\_header\_x\_forwarded\_for and request\_username from the log file. Any help/suggestion is appreciated. Regards, Utkarsh ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 9, 2019, 12:47pm UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/2 "2019-01-09T12:47:52Z")
Please format your code, logs or configuration files using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable. Or use markdown style like: ```` ``` CODE ``` ```` This is the icon to use if you are not using markdown format: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e6e239431ec2d71cbf1beef741f2e93e7cc762c.jpg) There's a live preview panel for exactly this reasons. Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text. If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible. Please update your post. ---
**Author:** ![utki](https://avatars.discourse-cdn.com/v4/letter/u/c57346/32.png) [@utki](https://discuss.elastic.co/u/utki)\ **Post date:** [January 10, 2019, 6:52am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/3 "2019-01-10T06:52:48Z")
Hi, Edited as directed. Regards, Utkarsh ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 10, 2019, 7:57am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/4 "2019-01-10T07:57:19Z")
Note that you need to format just the code part. Not all the text. I'm editing your posts. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 10, 2019, 7:59am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/5 "2019-01-10T07:59:42Z")
Did you define a mapping in elasticsearch? ---
**Author:** ![utki](https://avatars.discourse-cdn.com/v4/letter/u/c57346/32.png) [@utki](https://discuss.elastic.co/u/utki)\ **Post date:** [January 10, 2019, 8:41am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/6 "2019-01-10T08:41:01Z")
I have not done anything explicitly. I just sent the logs using logstash. Once my logs were imported, I was trying to create the dashboard but was not able to use the fields. You want me to delete the log file and then update the mapping as per the desired type? If yes, then m not very sure on how to do it. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 10, 2019, 8:56am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/7 "2019-01-10T08:56:44Z")
Yes. That's what you need to do. See [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html) ---
**Author:** ![utki](https://avatars.discourse-cdn.com/v4/letter/u/c57346/32.png) [@utki](https://discuss.elastic.co/u/utki)\ **Post date:** [January 17, 2019, 9:02am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/8 "2019-01-17T09:02:06Z")
Hi, I indexed my fields manually but now they are not appearing in Discover Tab. I need those fields to create dashboards. I have updated the time filter on top right corner as well. I can see my entry in Management Tab though. Please help. Regards, Utkarsh ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 17, 2019, 10:05am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/9 "2019-01-17T10:05:56Z")
You should ask a new question in #kibana and provide more details probably on what you are seeing. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 14, 2019, 10:05am UTC](https://discuss.elastic.co/t/i-need-to-index-my-field-as-type-keyword-as-oppose-to-type-text/163524/10 "2019-02-14T10:05:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.