# Mappings are "not\_analyzed" Can it be set with manage\_template **URL:** \ **Category:** Logstash\ **Created:** [September 9, 2016, 2:48pm UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172 "2016-09-09T14:48:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Tyler\_Siemers](https://avatars.discourse-cdn.com/v4/letter/t/ec9cab/32.png) [@Tyler\_Siemers](https://discuss.elastic.co/u/Tyler_Siemers)\ **Post date:** [September 9, 2016, 2:48pm UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/1 "2016-09-09T14:48:57Z")
I am importing logs from FireSight(cisco) into Logstash and outputting to Elasticsearch. Here is my conf file from Logstash. > input { > udp { > port =\> 5545 > type =\> "firesight" > } > } > filter { > grok { > patterns\_dir =\> ["./patterns"] > match =\> { "message" =\> "%{SYSLOGBASE} Protocol: %{WORD:protocol}, SrcIP: %{IP:srcIP}, DstIP: %{IP:dstIP}, SrcPort: %{NUMBER:srcPort}, DstPort: %{NUMBER:dstPort}, TCPFlags: %{WORD:tcpFlags}, IngressInterface: %{WORD:ingressINT}, EgressInterface: %{WORD:egressINT}, IngressZone: %{WORD:ingressZone}, EgressZone: %{WORD:egressZone}, DE: %{DATA:primaryDE}, Policy: %{WORD:policy}, ConnectType: %{WORD:connectType}, AccessControlRuleName: %{DATA:aclRuleName}, AccessControlRuleAction: %{WORD:aclRuleAction}, UserName: %{WORD:username}, UserAgent: %{DATA:userAgent}, Client: %{WORD:client}, ClientVersion: %{DATA:clientVer}, ApplicationProtocol: %{WORD:appProtocol}, InitiatorPackets: %{NUMBER:initPackets}, ResponderPackets: %{NUMBER:responderPackets}, InitiatorBytes: %{NUMBER:initBytes}, ResponderBytes: %{NUMBER:respondBytes}, NAPPolicy: %{DATA:NaPPolicy}, DNSResponseType: %{DATA:dnsResponseType}, Sinkhole: %{WORD:sinkhole}, HTTPReferer: %{URI:httpReferer}, ReferencedHost: %{DATA:referencedHost}, URLCategory: %{DATA:urlCategory}, URLReputation: %{DATA:urlReputation}, URL: %{URI:URL}"} > match =\> { "message" =\> "%{FIREPOWERBASE} ?(UserName: %{DATA:username})?,? ?(UserAgent: %{DATA:UserAgent})?,? Client: %{DATA:client}, ?(ClientVersion: %{DATA:ClientVersion})?,? ApplicationProtocol: %{WORD:appProtocol}, ?(WebApplication: %{DATA:WebApp})?,? %{FPPACKETRESPONSE} DNSResponseType: %{DATA:dnsResponseType}, Sinkhole: %{WORD:sinkhole}, ?(HTTPReferer: %{URI:httpReferer})?,? ?(ReferencedHost: %{DATA:ReferencedHost})?,? URLCategory: %{DATA:urlCategory}, URLReputation: %{DATA:urlReputation}, URL: %{URI:url}"} > match =\> { "message" =\> "%{FIREPOWERBASE} Client: %{DATA:client}, ApplicationProtocol: %{DATA:appProtocol}, %{FPPACKETRESPONSE} DNSResponseType: %{DATA:dnsResponseType}, Sinkhole: %{WORD:sinkhole}, URLCategory: %{DATA:urlCategory}, URLReputation: %{DATA:urlRep}"} > } > } > output { > elasticsearch { > hosts =\> ["10.50.184.119", "10.50.184.120", "10.50.184.121"] > index =\> "firesight-%{+YYYY.MM.dd}" > } > stdout {} > } I am trying to use the Visualize tab in Kibana and its coming back with the "not analyzed". I know i need to setup some mappings for the strings in Elastic. My question is can I use the "managed\_template" field in Logstash to achieve this? I would switch the conf file in Logstash output to add this: managed\_template =\> true Would this force it to use the default template of Logstash, which adds the .raw, or do I need to create my own template with custom mapping and point the output to that? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 11, 2016, 10:56am UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/2 "2016-09-11T10:56:19Z")
That's a pretty horrible grok pattern, why not use the KV filter - [Kv filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) That aside; > [@Tyler\_Siemers](#): > > managed\_template =\> true Yes that should do what you want 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 12, 2016, 5:28am UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/3 "2016-09-12T05:28:04Z")
> I am trying to use the Visualize tab in Kibana and its coming back with the "not analyzed". Really? I'm pretty sure ES defaults to analyzed strings. > I would switch the conf file in Logstash output to add this: > ``` > managed_template => true > > ``` It's `manage_template` not `managed_template` and it already defaults to true. > Would this force it to use the default template of Logstash, which adds the .raw, Logstash's default template only applies to logstash-\* indexes, but your indexes are firesight-\*. > or do I need to create my own template with custom mapping and point the output to that? You need to create your own template and either point Logstash to it (with `manage_template => true`) or manage the template yourself outside of Logstash (with `manage_template => false`) . ---
**Author:** ![Tyler\_Siemers](https://avatars.discourse-cdn.com/v4/letter/t/ec9cab/32.png) [@Tyler\_Siemers](https://discuss.elastic.co/u/Tyler_Siemers)\ **Post date:** [September 12, 2016, 4:43pm UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/4 "2016-09-12T16:43:12Z")
Their went a month of my life. The KV filter is light years better than what I was doing. Thanks. I ended having to use filter { kv { value\_split =\> ":" } } ---
**Author:** ![Tyler\_Siemers](https://avatars.discourse-cdn.com/v4/letter/t/ec9cab/32.png) [@Tyler\_Siemers](https://discuss.elastic.co/u/Tyler_Siemers)\ **Post date:** [September 12, 2016, 4:46pm UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/5 "2016-09-12T16:46:32Z")
Thanks. I'll have to end up creating my own template. The design we would like to have is a different index names for different network devices getting logged. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/mappings-are-not-analyzed-can-it-be-set-with-manage-template/60172/6 "2017-07-06T04:38:54Z")
Closed on July 6, 2017, 4:38am UTC