# Multi-field on CommandLine in Winlogbeat **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [January 2, 2018, 4:36pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810 "2018-01-02T16:36:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [January 2, 2018, 4:36pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/1 "2018-01-02T16:36:28Z")
I'm working with Winlogbeat and I need event\_data.CommandLine field to 'text' so I can run 'term' query on it and look for badness, I guess multi-fields is the way to go to add another field as text... Trying to get my head around this without screwing up what I already have - Current - ``` { "winlogbeat-2018.01.02": { "mappings": { "doc": { "event_data.CommandLine": { "full_name": "event_data.CommandLine", "mapping": { "CommandLine": { "type": "keyword", "ignore_above": 1024 } } } } } } } ``` Is this it? ``` PUT winlogbeat_multi { "mappings": { "cmdline": { "properties": { "event_data.CommandLine": { "type": "keyword", "ignore_above": 1024 "fields": { "text": { "type": "text" } } } } } } } ``` Questions: A) So then I should be able to use term on "event\_data.CommandLine.text"? B) This index will then be re-created each day? Thanks! ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [January 2, 2018, 6:31pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/2 "2018-01-02T18:31:05Z")
Even better would be to modify the default index to map strings to both text and keyword. ``` { "winlogbeat-2018.01.02": { "mappings": { "doc": { "_meta": { "version": "5.5.1" }, "dynamic_templates": [ { "strings_as_keyword": { "match_mapping_type": "string", "mapping": { "ignore_above": 1024, "type": "keyword" } } } ] ``` ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [January 4, 2018, 10:42pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/4 "2018-01-04T22:42:46Z")
Finally got this to work, at least I learned some stuff... I upgraded elkstack to 6.1.1 upgraded winlogbeats to 6.1.1 and then modified the winlogbeat.template.json to make event.data use a multi-field, both text and keyword - best of both worlds baby! ``` {, { "event_data": { "mapping": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "match_mapping_type": "string", "path_match": "event_data.*" } } ``` I deleted all the old winlogbeat indices - curl -XDELETE '[http://localhost:9200/winlogbeat-\*](http://localhost:9200/winlogbeat-*)' I added the new one that I modified, to overwrite the old one. curl -XDELETE '[http://localhost:9200/winlogbeat-\*](http://localhost:9200/winlogbeat-*)' curl -XPUT -H 'Content-Type: application/json' [http://localhost:9200/\_tem](http://localhost:9200/_tem) plate/winlogbeat -d@winlogbeat.template.json ...and voila. Questions: 1. Why, even after running curl -XDELETE '[http://localhost:9200/winlogbeat-\*](http://localhost:9200/winlogbeat-*)' are there still winlogbeat indexes in there from the last 3 days... yellow open winlogbeat-2018.01.02 FcFuDnxrQBSs3FNOzxO9gQ 5 1 65529 0 72.6mb 72.6mb yellow open winlogbeat-2018.01.03 W4Sk\_zfqSlSp5L3yP\_yAbg 5 1 89871 0 102.4mb 102.4mb yellow open winlogbeat-2018.01.01 BulBR2ClQcqp3VOcVbXblg 5 1 12134 0 14mb 14mb yellow open .kibana yPIY2NENSpOiseZ0JdrWwQ 1 1 17 9 80.1kb 80.1kb Helpful Posts - [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html) > [https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html) > **[Elasticsearch replaces string type with two new types text and keyword.](https://www.elastic.co/blog/strings-are-dead-long-live-strings)** > > On using text types for full text search and keyword type for keyword search in Elasticsearch 5.0. [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html) Helpful Console Commands - #list templates to see if it's in there GET \_template #searching for term in dev console will help by popping up suggestions - ``` GET /winlogbeat-2018.01.04/_search { "query": { "term": { "event_data.CommandLine": "net" } } } ``` -- now gotta get this to work with powershell.scriptblock.text! ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [January 16, 2018, 3:43pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/5 "2018-01-16T15:43:57Z")
Spoke too soon... term works now but the keyword field is now empty... ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [January 16, 2018, 7:24pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/6 "2018-01-16T19:24:11Z")
Maybe it would make sense to officially change the `event_data.CommandLine` field to be a multi-field. I think most users would benefit from this change. In Winlogbeat 6.x we generate the index templates for each specific ES version based on the data from [fields.yml](https://github.com/elastic/beats/blob/59f728a60239d5464575beef911b2ee9a9f2427e/winlogbeat/_meta/fields.yml#L40-L49). I think it would work we added another field to that field named `event_data.CommandLine` that uses config like the `file.path` in Auditbeat which is a multi-field. [https://github.com/elastic/beats/blob/59f728a60239d5464575beef911b2ee9a9f2427e/auditbeat/module/file\_integrity/\_meta/fields.yml#L17-L25](https://github.com/elastic/beats/blob/59f728a60239d5464575beef911b2ee9a9f2427e/auditbeat/module/file_integrity/_meta/fields.yml#L17-L25) The `fields.yml` file is shipped in the root of the zip download package for Winlogbeat 6.x. Once the file is updated you can test the changes by looking at the generated index template by using: ```auto .\winlogbeat.exe export template --es.version=5.6.5 ``` ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [January 16, 2018, 10:10pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/7 "2018-01-16T22:10:47Z")
Hey @andrewkroh !! That would definitely make things easier on me, and that's good to know about the fields.yml! Thank you so much - I cleaned it up and sort of re-asked it here, if I could close it I would... > [@Winlogbeat modified to Text and Keyword](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754/2): > > Alright correction, the field doesn't work in the 'Discover', but I can do aggregations in Visualize???? No idea what I did... but the field is empty in 'Discover' -- [image] No idea... but appreciate any suggestions. I am definitely going to redo this using the fields.yml. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 13, 2018, 10:10pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810/8 "2018-02-13T22:10:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.