# Metricbeat fields defaults
**URL:** https://discuss.elastic.co/t/metricbeat-fields-defaults/100365
**Category:** Beats
**Tags:** metricbeat
**Created:** [September 13, 2017, 1:43pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365 "2017-09-13T13:43:09Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)
#### Post date: [September 13, 2017, 1:43pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/1 "2017-09-13T13:43:09Z")
Hi,
I'm running a test cluster and a production cluster, metricbeats is one of the things posting data into both of these.
In the metricbeat-\* index pattern on my dev cluster the `host` field is searchable and aggregatable but on my production cluster I have a `host` field (searchable and analyzed) and a `host.keyword` (searchable and aggregatable) alongside it. I don't know how that got there, I haven't been messing with the mapping API or the template files.
Because my dev/prod clusters have different fields it's messing up my [ElastAlert](https://github.com/Yelp/elastalert) YAML, one references host and the other needs host.keyword.
Which setup is correct according to MetricBeat defaults and how do I get them in sync?
Gog
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 13, 2017, 2:57pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/2 "2017-09-13T14:57:38Z")
It sounds like the prod cluster doesn't have the index template installed. The `host` field should be a [keyword datatype](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/keyword.html). See [Loading the Index Template in Elasticsearch](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html).
---
### Author:  [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)
#### Post date: [September 13, 2017, 3:07pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/3 "2017-09-13T15:07:58Z")
I wondered that too, but I don't remember having to do that in the dev cluster.
If I do post the template to the prod cluster presumably all new indexes will adhere to it but it won't apply to the existing data?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 13, 2017, 4:09pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/4 "2017-09-13T16:09:16Z")
That's correct. It will not apply retroactively. The data in those indices would need to [reindexed](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html).
---
### Author:  [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)
#### Post date: [September 14, 2017, 7:53am UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/5 "2017-09-14T07:53:26Z")
Reindexing metricbeats data is hard... 😛
I'll `curl` the template in and post back with the results.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 14, 2017, 2:31pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/6 "2017-09-14T14:31:33Z")
> [@GogLlundain](#):
>
> Reindexing metricbeats data is hard...
Reindexing is pretty easy with the reindex API.
```auto
POST _reindex
{
"source": {
"index": "metricbeat-2017.01.01"
},
"dest": {
"index": "metricbeat-2017.01.01-a"
}
}
```
Then after that completes you delete the metricbeat-2017.01.01 index.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 12, 2017, 2:31pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365/7 "2017-10-12T14:31:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.