# Is this an OK addition of doc\_values : true in elasticsearch template with logstash?
**URL:** https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361
**Category:** Elasticsearch
**Created:** [September 16, 2015, 4:08am UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361 "2015-09-16T04:08:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@martbhell](https://discuss.elastic.co/u/martbhell)
#### Post date: [September 16, 2015, 4:08am UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361/1 "2015-09-16T04:08:19Z")
Hi,
got a little tired of memory issues and figured I'd try enabling doc\_value and see if this helps (eventually as indexes are created).
This is for a central log ELK stack, kibana3 & 4. ES 1.7.
Should I add it in more / less places in the template?
The template (pastebin: [elasticsearch-template.json from logstash with doc\_value - Pastebin.com](http://pastebin.com/99h3HPzx) ):
> {
> "template" : "logstash-_",
> "aliases" : {
> "alias1" : {},
> "dcachebilling" : {
> "filter" : {
> "term" : {
> "type" : "dcache\_billing"
> }
> }
> }
> },
> "settings" : {
> "index.refresh\_interval" : "5s",
> "number\_of\_shards" : 4
> },
> "mappings" : {
> "default" : {
> "\_all" : {"enabled" : true, "omit\_norms" : true, **"doc\_value" : true}** ,
> "dynamic\_templates" : [ {
> "message\_field" : {
> "match" : "message",
> "match\_mapping\_type" : "string",
> "mapping" : {
> "type" : "string", "index" : "analyzed", "omit\_norms" : true, **"doc\_value" : true**
> }
> }
> }, {
> "string\_fields" : {
> "match" : "_",
> "match\_mapping\_type" : "string",
> "mapping" : {
> "type" : "string", "index" : "analyzed", "omit\_norms" : true, **"doc\_value" : true,**
> "fields" : {
> "raw" : {"type": "string", "index" : "not\_analyzed", "ignore\_above" : 256, **"doc\_value" : true** }
> }
> }
> }
> } ],
> "properties" : {
> "@version": { "type": "string", "index": "not\_analyzed" },
> "type": { "type": "string", "index": "not\_analyzed" },
> "geoip" : {
> "type" : "object",
> "dynamic": true,
> "path": "full",
> "properties" : {
> "location" : { "type" : "geo\_point" }
> }
> }
> }
> }
> }
> }
// mart
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 16, 2015, 4:19am UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361/2 "2015-09-16T04:19:08Z")
IIRC doc values only work for non-analyzed fields.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 16, 2015, 4:37am UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361/3 "2015-09-16T04:37:46Z")
@magnusbaeck is correct.
---
### Author:  [@martbhell](https://discuss.elastic.co/u/martbhell)
#### Post date: [September 16, 2015, 5:52am UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361/4 "2015-09-16T05:52:47Z")
Thanks.
I tried to parse the template, are these statements true ?:
the \_all mapping - all fields will with this one get doc\_value enabled and whatever the default of index: is.
- Except that within this mapping there's an exception for the "message" field - setting it to analyzed.
the string\_fields mapping sets "\*" to analyzed strings (and doc\_value but that's probably without effect).
- Has an exception for the raw fields which are not\_analyzed.
Making only these fields analyzed fields with doc\_value enabled:
- .raw fields
- the two not\_analyzed fields in the "properties" section of the template
?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:50pm UTC](https://discuss.elastic.co/t/is-this-an-ok-addition-of-doc-values-true-in-elasticsearch-template-with-logstash/29361/5 "2017-07-05T23:50:09Z")