# .keyword doesn't exist

**URL:** https://discuss.elastic.co/t/keyword-doesnt-exist/153132
**Category:** Kibana
**Created:** [October 19, 2018, 7:47am UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132 "2018-10-19T07:47:45Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)
#### Post date: [October 19, 2018, 7:47am UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132/1 "2018-10-19T07:47:46Z")

</div>

I have logs of a server indexed on my ES. The message body of the logs is in the field named message. Now if I try to aggregate on the field message.keyword. That field doesn't exist for a certain number of logs.  
After some research I found that ES maps each string field to two fields. Which in my case should be

```
message
message.keyword

```

But somhow the second field doesn't exist for some logs, although those events have a valid string in their message field. What could be the reason?

---

<div class="post-metadata">

### Author: ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [October 19, 2018, 3:57pm UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132/2 "2018-10-19T15:57:27Z")

</div>

Hmm, that seems strange, could you provide the mapping for your index here?

Are you saying `message.keyword` is only missing for some of the logs, but the `message` field is still there in them?

---

<div class="post-metadata">

### Author: ![njam](https://avatars.discourse-cdn.com/v4/letter/n/4da419/32.png) [@njam](https://discuss.elastic.co/u/njam)
#### Post date: [November 14, 2018, 3:19pm UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132/3 "2018-11-14T15:19:13Z")

</div>

I have the same.  
_Only_ the field `message` does not have a `.keyword` counterpart.

Mapping:

```auto
        "message": {
          "type": "text",
          "norms": false
        },

```

Logstash 6.4.2

Is this on purpose? Can it be enabled also for "message"?

---

<div class="post-metadata">

### Author: ![njam](https://avatars.discourse-cdn.com/v4/letter/n/4da419/32.png) [@njam](https://discuss.elastic.co/u/njam)
#### Post date: [November 14, 2018, 3:43pm UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132/4 "2018-11-14T15:43:52Z")

</div>

Seems to be on purpose. The default mapping doesn't create a `.keyword` fields for "message".  
Relevant parts from the mapping template:

```auto
      "dynamic_templates": [
        {
          "message_field": {
            "path_match": "message",
            "match_mapping_type": "string",
            "mapping": {
              "norms": false,
              "type": "text"
            }
          }
        },
        {
          "string_fields": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "fields": {
                "keyword": {
                  "ignore_above": 256,
                  "type": "keyword"
                }
              },
              "norms": false,
              "type": "text"
            }
          }
        }
      ],

```

Seems a bit strange, but ok.  
One can manage the template himself ([docs](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template)), or use a different field name than "message".

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2018, 3:44pm UTC](https://discuss.elastic.co/t/keyword-doesnt-exist/153132/5 "2018-12-12T15:44:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.