# Message.keyword does not exists

**URL:** <https://discuss.elastic.co/t/message-keyword-does-not-exists/181028>\
**Category:** Beats\
**Created:** [May 14, 2019, 3:32pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028 "2019-05-14T15:32:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![qsadmin](https://avatars.discourse-cdn.com/v4/letter/q/dfb087/32.png) [@qsadmin](https://discuss.elastic.co/u/qsadmin)\
**Post date:** [May 14, 2019, 3:32pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/1 "2019-05-14T15:32:34Z")

</div>

Hi,

i have the same problem as in this thread: [.keyword doesn't exist](https://discuss.elastic.co/t/keyword-doesnt-exist/153132)

Background: I have updated the elk-stack from version 6.7 to 7. After the update i can not see message.keyword in my index "filebeat-_". But at my index "winlogbeat-_" there is field message.keyword. I need these field for terms in metrics. Refresh field list did not help.

 ![2019-05-14%2017_28_37-filebeat-_%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0c844b37f5ba63a275372b248a97fe2a94f32045.jpeg) ![2019-05-14%2017_28_44-winlogbeat-_%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb5f1f09ef5e3f9dca8d499fef7dfe917ec8f600.jpeg)

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [May 14, 2019, 3:40pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/2 "2019-05-14T15:40:42Z")

</div>

I am going to move this to the Beats thread - hopefully someone there is better suited to assist with Beats mappings.

---

<div class="post-metadata">

**Author:** ![qsadmin](https://avatars.discourse-cdn.com/v4/letter/q/dfb087/32.png) [@qsadmin](https://discuss.elastic.co/u/qsadmin)\
**Post date:** [May 15, 2019, 9:04am UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/3 "2019-05-15T09:04:48Z")

</div>

I am not sure if my problem is a Beats problem. After some additional research i think its belongs to logstash and the default template which logstash load in elasticserch.

---

<div class="post-metadata">

**Author:** ![qsadmin](https://avatars.discourse-cdn.com/v4/letter/q/dfb087/32.png) [@qsadmin](https://discuss.elastic.co/u/qsadmin)\
**Post date:** [May 15, 2019, 12:15pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/4 "2019-05-15T12:15:59Z")

</div>

If i enter the following in the console:

> PUT filebeat-7.0.1-2019.05.15  
> {  
> "mappings": {  
> "dynamic\_templates": [  
> {  
> "strings": {  
> "match\_mapping\_type": "string",  
> "mapping": {  
> "type": "text",  
> "fields": {  
> "raw": {  
> "type": "keyword",  
> "ignore\_above": 256  
> }  
> }  
> }  
> }  
> }  
> ]  
> }  
> }

I get the following result:

> {  
> "error": {  
> "root\_cause": [  
> {  
> "type": "resource\_already\_exists\_exception",  
> "reason": "index [filebeat-7.0.1-2019.05.15/88mn-6AbTJe2D0lNVlRIbg] already exists",  
> "index\_uuid": "88mn-6AbTJe2D0lNVlRIbg",  
> "index": "filebeat-7.0.1-2019.05.15"  
> }  
> ],  
> "type": "resource\_already\_exists\_exception",  
> "reason": "index [filebeat-7.0.1-2019.05.15/88mn-6AbTJe2D0lNVlRIbg] already exists",  
> "index\_uuid": "88mn-6AbTJe2D0lNVlRIbg",  
> "index": "filebeat-7.0.1-2019.05.15"  
> },  
> "status": 400  
> }

---

<div class="post-metadata">

**Author:** ![qsadmin](https://avatars.discourse-cdn.com/v4/letter/q/dfb087/32.png) [@qsadmin](https://discuss.elastic.co/u/qsadmin)\
**Post date:** [May 15, 2019, 1:01pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/5 "2019-05-15T13:01:24Z")

</div>

solved it with an reindex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2019, 1:02pm UTC](https://discuss.elastic.co/t/message-keyword-does-not-exists/181028/6 "2019-06-12T13:02:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.