# Map keyword field in kibana 6.3.0
**URL:** https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821
**Category:** Elasticsearch
**Created:** [October 10, 2018, 10:33am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821 "2018-10-10T10:33:39Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 10, 2018, 10:33am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/1 "2018-10-10T10:33:39Z")
Hi
In latest verson of kibana 6.3.0, there are separate fields. One is without "keyword" and another is with "keyword". I want to map both fields and showed a single one.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 10, 2018, 11:24am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/2 "2018-10-10T11:24:32Z")
You need to adapt your mapping and remove most likely the keyword one if you don't use it.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 10, 2018, 12:27pm UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/3 "2018-10-10T12:27:24Z")
Hi @dadoonet
Could you please provide me an example.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 12, 2018, 2:33pm UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/4 "2018-10-12T14:33:15Z")
Hi @dadoonet
Could you please provide me an example?
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 12, 2018, 3:01pm UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/5 "2018-10-12T15:01:46Z")
In your template there's no `keyword` field so probably this field is generated by your application or anything which is calling elasticsearch.
Check your ingestion layer.
If you don't find it, could you share the output of:
```auto
GET Input-*/_search?size=1
```
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 12, 2018, 4:15pm UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/6 "2018-10-12T16:15:33Z")
Hi @dadoonet
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 12, 2018, 5:19pm UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/7 "2018-10-12T17:19:48Z")
Could you run:
```auto
GET /Input-*/_search?size=1
{
"query": {
"exists" : { "field" : "@version.keyword" }
}
}
```
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 2:12am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/9 "2018-10-13T02:12:06Z")
```auto
"took": 3,
"timed_out": false,
"_shards": {
"total": 10,
"successful": 10,
"skipped": 0,
"failed": 0
},
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 7:46am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/10 "2018-10-13T07:46:10Z")
What is the output of:
```auto
GET Input-2018.10.12/_mapping
```
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 8:44am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/11 "2018-10-13T08:44:32Z")
Hi @dadoonet
```auto
{
"Input-2018.10.13": {
"mappings": {
"doc": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 9:29am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/12 "2018-10-13T09:29:12Z")
What is the output of:
```auto
GET /_template
```
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 9:40am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/13 "2018-10-13T09:40:10Z")
Hi @dadoonet
```auto
"logstash": {
"order": 0,
"index_patterns": [
"Input-%{+YYYY.MM.dd}"
],
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 9:42am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/14 "2018-10-13T09:42:03Z")
Can you share the **full output** of the previous request? Here you copied only one part I think. At least this is not consistent with what you pasted so far.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 9:44am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/15 "2018-10-13T09:44:47Z")
Hi @dadoonet
Because of text limit, full information is not coming.
```auto
{
"kibana_index_template:.kibana": {
"order": 0,
"index_patterns": [
".kibana"
],
"settings": {
"index": {
"number_of_shards": "1",
"auto_expand_replicas": "0-1"
}
},
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 9:45am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/16 "2018-10-13T09:45:35Z")
Then share it as a gist on [gist.github.com](http://gist.github.com) and paste the link here.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 9:52am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/17 "2018-10-13T09:52:33Z")
Hi @dadoonet
```auto
https://gist.github.com/hello/6e1803ea3a692ac45a7e0d6175e91fb4
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 10:14am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/18 "2018-10-13T10:14:45Z")
I think I understand now.
In the logstash template you have:
```auto
"index_patterns": [
"event-%{+YYYY.MM.dd}"
],
```
Where I believe it should be:
```auto
"index_patterns": [
"event-*"
],
```
So the logstash template is not applied to your index when the index is created the first time which explains why you have all default elasticsearch behavior.
Also, I don't understand why you have been saying that the index name is `Input-2018.10.13` if actually the template is applied on `event-*`. That does not make sense to me.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 13, 2018, 10:19am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/19 "2018-10-13T10:19:53Z")
Hi @dadoonet
I want to use index pattern **event-%{+YYYY.MM.dd}** , but it is not matching with kibana index pattrn.
That is why I am using **event-** \*.
Please let me know right index pattern.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 13, 2018, 11:48am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/20 "2018-10-13T11:48:44Z")
No I meant your elasticsearch index template is incorrect. Fix it.
---
### Author:  [@deepsing](https://discuss.elastic.co/u/deepsing)
#### Post date: [October 14, 2018, 3:03am UTC](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821/21 "2018-10-14T03:03:49Z")
Hi @dadoonet
I am using below index in logstash.conf
```auto
output {
elasticsearch {
index => "event-%{+YYYY.MM.dd}"
hosts => ["localhost"]
template => "c:/elasticsearc/template.json"
}
```
Do I also need to change it?
Actually I want to make the index in the form of "event-YYYY.MM.dd"
Thanks
Deepak
[Next page](https://discuss.elastic.co/t/map-keyword-field-in-kibana-6-3-0/151821.md?page=2)