# Need HELP with mapping referring to log output

**URL:** <https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520>\
**Category:** Elasticsearch\
**Created:** [March 13, 2020, 1:46pm UTC](https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520 "2020-03-13T13:46:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![carmine.fabrizio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmine.fabrizio/32/71788_2.png) [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\
**Post date:** [March 13, 2020, 1:46pm UTC](https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520/1 "2020-03-13T13:46:43Z")

</div>

Hi,  
I am trying to understand how to define some static mapping, this is the log message that I have

`Mar 12 17:27:16 dev-jenkins filebeat: 2020-03-12T17:27:16.768-0400#011INFO#011[monitoring]#011log/log.go:145#011Non-zero metrics in the last 30s#011{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":169260,"time":{"ms":17}},"total":{"ticks":267930,"time":{"ms":33},"value":267930},"user":{"ticks":98670,"time":{"ms":16}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"29de85a9-3829-48f3-9a37-83f35c65038e","uptime":{"ms":126930091}},"memstats":{"gc_next":10604144,"memory_alloc":9763784,"memory_total":7550838208},"runtime":{"goroutines":46}},"filebeat":{"events":{"added":1,"done":1},"harvester":{"files":{"ac2ff12a-149c-4962-9b61-9454123d53f3":{"last_event_published_time":"2020-03-12T17:26:53.726Z","last_event_timestamp":"2020-03-12T17:26:48.725Z","read_offset":1261,"size":1261}},"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":1,"batches":1,"total":1},"read":{"bytes":6},"write":{"bytes":1146}},"pipeline":{"clients":4,"events":{"active":0,"published":1,"total":1},"queue":{"acked":1}}},"registrar":{"states":{"current":2,"update":1},"writes":{"success":1,"total":1}},"system":{"load":{"1":0.01,"15":0.05,"5":0.02,"norm":{"1":0.005,"15":0.025,"5":0.01}}}}}}`

as you can see is a Syslog message coming from the filebeat.  
Let say I'd like to create a mapping based on this output and create the fields name on kibana, I should start to map the field like this

```
{
  "properties": {
    "monitoring.metrics.beat.cpu.system.ticks": {
      "full_name" : "cpu.system.ticks",
      "mapping": {
        "type": "number"
        }
      },
      "monitoring.metrics.beat.cpu.system.ticks.keyword": {
        "full_name" : "cpu.system.ticks.keyword",
        "mapping": {
          "keyword" : {
            "type": "keyword",
            "ignore_above" : 256
            }
        }
      }
  }
}

```

am I right? of course not coz It is not working 🙂 ao any idea about what am I missing?  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2020, 1:46pm UTC](https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520/2 "2020-04-10T13:46:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.