# Logstash not populating .raw values
**URL:** https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333
**Category:** Logstash
**Created:** [July 25, 2016, 9:02pm UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333 "2016-07-25T21:02:07Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@john.miles](https://discuss.elastic.co/u/john.miles)
#### Post date: [July 25, 2016, 9:02pm UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/1 "2016-07-25T21:02:07Z")
I have filebeat set up to ship my nginx logs over to logstash and logstash is updating my indices with the log data. I am using the logstash-\* template (though my index is called logstash-appname-prod-web-access-logs-YYYY.MM.dd.
In Kibana, I can see that there are .raw fields being created but they are not being populated with any values. When i go to build my visualization to show the distribution based on host\_name, the aggregation fails because all host.raw values are null.
What am I missing?
---
### Author:  [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)
#### Post date: [July 26, 2016, 2:32am UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/2 "2016-07-26T02:32:57Z")
John,
What does the mapping of the `host` (or is it `host_name`?) property look like in a recent index?
Do any documents return from that index if you perform [an exists query](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/query-dsl-exists-query.html) on that index for the `host` or `host_name` field?
Glen
---
### Author:  [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)
#### Post date: [July 26, 2016, 3:33am UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/3 "2016-07-26T03:33:31Z")
If you change the index name the .raw value mapping for logstash, it doesn't work as it should. Try not setting the index value in logstash.conf file and also if you are keen on using custom index, create a new mapping/template in elasticsearch for the same.
[https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html)
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 26, 2016, 5:47am UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/4 "2016-07-26T05:47:06Z")
You didn't change the `document_type` in the output did you? If not, providing the full config might help.
> [@niraj\_kumar](#):
>
> If you change the index name the .raw value mapping for logstash, it doesn't work as it should
But they're using `logstash-appname-prod-web-access-logs-YYYY.MM.dd` which matches the pattern of `logstash-`.
---
### Author:  [@john.miles](https://discuss.elastic.co/u/john.miles)
#### Post date: [July 26, 2016, 12:37pm UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/5 "2016-07-26T12:37:35Z")
I don't think I changed it.
Logstash config (same configuration for all nginx log indices:
input {
beats {
port =\> 5052
}
}
filter {
grok {
match =\> { "message" =\> '%{IPORHOST:lbip} %{NGUSER:ident} %{NGUSER:auth} [%{HTTPDATE:logdate}] %{NUMBER:response} "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent} "%{GREEDYDATA:clientIPs}"' }
}
```
date {
locale => en
match => ["logdate", "dd/MMM/YYYY:HH:mm:ss Z"]
remove_field => "logdate"
}
useragent {
source => "agent"
target => "useragent"
remove_field => "agent"
}
csv {
# separate client IP from reverse proxy IP
columns => ["clientip", "rp_ip"]
source => "clientIPs"
separator => ","
}
geoip {
source => "clientip"
}
```
}
output {
elasticsearch {
hosts=\> ["10.8.154.31:9200","10.8.154.33:9200"]
index =\> "logstash-rostr-prod-web-access-logs-%{+YYYY.MM.dd}"
}
}
Here is the definition of my logstash template:
curl -XGET 10.8.154.30:9200/\_template/logstash\*
{"logstash":{"order":0,"template":"logstash-_","settings":{"index":{"refresh\_interval":"5s"}},"mappings":{"default":{"dynamic\_templates":[{"message\_field":{"mapping":{"index":"analyzed","omit\_norms":true,"fielddata":{"format":"disabled"},"type":"string"},"match\_mapping\_type":"string","match":"message"}},{"string\_fields":{"mapping":{"index":"analyzed","omit\_norms":true,"fielddata":{"format":"disabled"},"type":"string","fields":{"raw":{"index":"not\_analyzed","ignore\_above":256,"type":"string"}}},"match\_mapping\_type":"string","match":"_"}}],"properties":{"@timestamp":{"type":"date"},"geoip":{"dynamic":true,"properties":{"location":{"type":"geo\_point"},"longitude":{"type":"float"},"latitude":{"type":"float"},"ip":{"type":"ip"}}},"@version":{"index":"not\_analyzed","type":"string"}},"\_all":{"enabled":true,"omit\_norms":true}}},"aliases":{}}}
---
### Author:  [@john.miles](https://discuss.elastic.co/u/john.miles)
#### Post date: [July 26, 2016, 2:22pm UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/6 "2016-07-26T14:22:08Z")
It is also not respecting the definintion of the fields being parsed. Clearly, the logstash grok filter shows that reponse and bytes are supposed to come across as NUMBERs but the index configuration page within Kibana shows them as strings. In fact, everything is coming in as strings except for the geoip fields.
---
### Author:  [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)
#### Post date: [July 27, 2016, 2:27am UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/7 "2016-07-27T02:27:43Z")
> [@john.miles](#):
>
> Clearly, the logstash grok filter shows that reponse and bytes are supposed to come across as NUMBERs but the index configuration page within Kibana shows them as strings.
You need to [mutate.convert them](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert)
> [@john.miles](#):
>
> "match\_mapping\_type":"string","match":""
That won't match anything.
Again, please provide a recent _mapping_ of the field you are interested in from a recent index in Elasticsearch.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/logstash-not-populating-raw-values/56333/8 "2017-07-06T04:46:23Z")