# .keyword conversion fails **URL:** \ **Category:** Kibana\ **Created:** [October 3, 2017, 5:14am UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508 "2017-10-03T05:14:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![shshnk28](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@shshnk28](https://discuss.elastic.co/u/shshnk28)\ **Post date:** [October 3, 2017, 5:14am UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/1 "2017-10-03T05:14:25Z")
I am monitoring a bunch of servers using the ELK stack. I want to monitor custom Java processes that are being run from jars on those servers. I am trying to split the line graph using the `system.process.cmdline.keyword` feature. But `system.process.cmdline.keyword` field is absent for some types of command while the corresponding `system.process.cmdline` is present. I am guessing `.keyword` conversion logic fails in these cases. Does not work for [this](https://pastebin.com/sS7byiu3). Works for [this](https://pastebin.com/RN88S1ju). Please notice the difference in command line field in both the cases. Any help here is appreciated. Been stuck over this for long ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [October 4, 2017, 5:47pm UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/2 "2017-10-04T17:47:37Z")
Do you mind providing your mapping? ---
**Author:** ![shshnk28](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@shshnk28](https://discuss.elastic.co/u/shshnk28)\ **Post date:** [October 8, 2017, 4:54pm UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/3 "2017-10-08T16:54:00Z")
Hi @lukas, Pls find the mapping for `system.process.cmdline.keyword`. Providing only a snippet [here](https://pastebin.com/YmyVfKC4) which I think is relevant as the entire mapping is more than 800 lines. Let me know if you need more info. Thanks ---
**Author:** ![shshnk28](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@shshnk28](https://discuss.elastic.co/u/shshnk28)\ **Post date:** [October 9, 2017, 5:40pm UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/4 "2017-10-09T17:40:54Z")
Okay I was able to get it working after increasing the `ignore_above` limit for one index. But this leads me to another problem. I am maintaining an ELK stack and my indexes are created by logstash output on a daily basis. So I cannot manually update the mapping everyday. I want to increase/remove this limit permanently for all the indexes that will be created. How can this be achieved ? ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [October 9, 2017, 10:52pm UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/5 "2017-10-09T22:52:23Z")
You can provide a custom mapping for your logstash input. Could you provide your logstash config? ---
**Author:** ![shshnk28](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@shshnk28](https://discuss.elastic.co/u/shshnk28)\ **Post date:** [October 11, 2017, 4:18am UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/6 "2017-10-11T04:18:56Z")
Thanks for your response @lukas. Please [find](https://pastebin.com/nkmSkTya) the logstash config which is sending data to elastic search for indexing. Can you please let me know how can I provide the custom mapping? ---
**Author:** ![shshnk28](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@shshnk28](https://discuss.elastic.co/u/shshnk28)\ **Post date:** [October 13, 2017, 11:02am UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/7 "2017-10-13T11:02:05Z")
I was able to fix this using a custom [template](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html). Exactly what I was looking for ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 10, 2017, 11:02am UTC](https://discuss.elastic.co/t/keyword-conversion-fails/102508/8 "2017-11-10T11:02:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.