# Keyword Field Generation

**URL:** <https://discuss.elastic.co/t/keyword-field-generation/269724>\
**Category:** Kibana\
**Created:** [April 9, 2021, 3:29pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724 "2021-04-09T15:29:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LED](https://avatars.discourse-cdn.com/v4/letter/l/7c8e57/32.png) [@LED](https://discuss.elastic.co/u/LED)\
**Post date:** [April 9, 2021, 3:29pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724/1 "2021-04-09T15:29:05Z")

</div>

Hi All,

I have setup two identical ELK Stacks (in theory) for Dev and Test. We have Metricbeat shipping data into their respective clusters. In our Test environment I've noticed that ".keyword" is being added to the majority of field names when creating visualisations but this has not happened in Dev.

Is there are particular action or setting that causes this to happen? Ideally it would be nice to have consistency across both stacks.

Any help would be really appreciated as I'm not ELK expert.

Thanks, Lee

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 10, 2021, 6:01am UTC](https://discuss.elastic.co/t/keyword-field-generation/269724/2 "2021-04-10T06:01:01Z")

</div>

The mappings are not the same, most likely the mapping was not applied to Test ... those `.keywords` are when the default mapping is used (i.e. no mapping is provided)

Most likely with metricbeat ...  
`metricbeat setup -e`  
was not run while pointing to the Test Cluster.

You need to run `metribeat setup -e` against each cluster at least once.

---

<div class="post-metadata">

**Author:** ![LED](https://avatars.discourse-cdn.com/v4/letter/l/7c8e57/32.png) [@LED](https://discuss.elastic.co/u/LED)\
**Post date:** [April 14, 2021, 7:17am UTC](https://discuss.elastic.co/t/keyword-field-generation/269724/3 "2021-04-14T07:17:12Z")

</div>

> [@stephenb](#):
>
> Most likely with metricbeat ...  
> `metricbeat setup -e`  
> was not run while pointing to the Dev C

Thank you! I'll give it a try and report back.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 14, 2021, 2:04pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724/4 "2021-04-14T14:04:31Z")

</div>

I think I had a typo, looks like setup was not run on the Test Cluster, (I think I wrote Dev I have since corrected) . You will probably need to cleanup and then run setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2021, 2:05pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724/5 "2021-05-12T14:05:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.