# Index fields with keyword

**URL:** <https://discuss.elastic.co/t/index-fields-with-keyword/188203>\
**Category:** Kibana\
**Created:** [June 30, 2019, 5:43pm UTC](https://discuss.elastic.co/t/index-fields-with-keyword/188203 "2019-06-30T17:43:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan\_Kaspar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jan_kaspar/32/44443_2.png) [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\
**Post date:** [June 30, 2019, 5:43pm UTC](https://discuss.elastic.co/t/index-fields-with-keyword/188203/1 "2019-06-30T17:43:44Z")

</div>

Hi All,

I made upgrade of ELK 7.1.1 to ELK 7.0. I upgraded also one of 10 metrcibeat from 7.1.1 to 7.2.

upgraded host disappear from build in visualize Top Hosts By CPU (Realtime) [Metricbeat System] ECS.

I fouind that it is caused in group by section in By field. There was host.name and it works for all 7.1.1 and now upgraded server have field host.name.keyword. How to solve this?

default output in metrixbeat is logstash. logstash is configured by ths way:

```
hosts => ["192.168.5.5:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

```

Thanks

Jan

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [July 5, 2019, 1:54pm UTC](https://discuss.elastic.co/t/index-fields-with-keyword/188203/2 "2019-07-05T13:54:11Z")

</div>

You can edit the visualization and change from the host.name to host.name.keyword or you can use the `mutate` filter in Logstash to copy the field to the missing one:  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)

But these would be ugly fixes, i'd recommend you upgrade all metricbeat instancesto the same version and then do the dashboard setup with the new 7.2 dashboards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2019, 1:54pm UTC](https://discuss.elastic.co/t/index-fields-with-keyword/188203/3 "2019-08-02T13:54:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.