# Mac address changed to mixed datatype in elastic

**URL:** <https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051>\
**Category:** Elasticsearch\
**Created:** [February 4, 2025, 9:16am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051 "2025-02-04T09:16:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![meghananagaraja](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@meghananagaraja](https://discuss.elastic.co/u/meghananagaraja)\
**Post date:** [February 4, 2025, 9:16am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051/1 "2025-02-04T09:16:27Z")

</div>

I am feeding data into ES index. The data has mac address. Elastic is mapping it to a mixed data type (part string part numeric). How to fix this issue. I am not able to use "term" option while querying. It wont fetch.  
 ![Capture11](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1cf7a872e5b9414b50a3c4e5290bd338d29b6c0a.jpeg)  
i tried mapping it to keyword

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [February 5, 2025, 2:47am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051/2 "2025-02-05T02:47:56Z")

</div>

Hi @meghananagaraja. Welcome!!

How are you mapping the field deviceId in the index?  
How are you doing the Term query, using the keyword field and the full or partial MAC?

---

<div class="post-metadata">

**Author:** ![meghananagaraja](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@meghananagaraja](https://discuss.elastic.co/u/meghananagaraja)\
**Post date:** [February 5, 2025, 10:00am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051/3 "2025-02-05T10:00:24Z")

</div>

Thank you @RabBit_BR for your quick response. Here is the mapping i used while creating index

```json
    mapping = {
        "mappings": {
            "properties": {
                "deviceId": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                },

```

I am querying from a python app

```auto
    if deviceId:
        search_body['query']['bool']['must'].append({
            "term": {"deviceId.keyword": deviceId}
        })

```

The above query is fetching results. But how do i prevent this incorrect dynamic mapping in the first place.

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [February 5, 2025, 10:53am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051/4 "2025-02-05T10:53:38Z")

</div>

If you do not explicitly define the fields in the mapping, when a new unmapped property is indexed it will generate the field with type text and the keyword, this is the default behavior.

You can use another approach, you can use a [dynamic template](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html). A dynamic template allows you to define rules so that certain fields are automatically mapped according to specific patterns, such as the field name.

```auto
PUT /idx
{
  "mappings": {
    "dynamic_templates": [
      {
        "deviceId_as_keyword": {
          "match": "deviceId",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ]
  }
}

```