# No .raw field in kibana **URL:** \ **Category:** Logstash\ **Created:** [August 25, 2017, 11:35pm UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425 "2017-08-25T23:35:05Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Post date:** [August 25, 2017, 11:35pm UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425/1 "2017-08-25T23:35:05Z")
I am seeing an issues where i am not seeing .raw fields but instead i am seeing .keyword fields. I know there was a problem when you change the default index name from logstash-\* to something else but couldn't recall the fix for it. How do i get the raw fields back? Any idea. Also as i have already ingested so many data now. Is there a way to re-index those data to get the .raw fields. This broke my dashboard too. Logstash Version:- 5.5 ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 26, 2017, 12:13am UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425/2 "2017-08-26T00:13:22Z")
It's in the default index template. You would have to change your template. I recommend updating it for Elasticsearch 5.x anyway, as mapping changes occurred (even if you preserve `.raw` instead of `.keyword`). To "fix" your `.keyword` fields, you will have to re-index your data using the Reindex API, or potentially the [Reindex action](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/reindex.html) in Elasticsearch Curator. It might be easier/better to fix the dashboards to use `.keyword` and reindex the _old_ data to also be `.keyword`, but I have no idea what scale or volume of data you're dealing with. ---
**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Post date:** [August 26, 2017, 12:58am UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425/3 "2017-08-26T00:58:01Z")
@theuntergeek Consider me as newbie , could you suggest how to update the default template. My problem with updating the template is that the index names are dynamic. How can i update a template that will match any new index that i create. I don't have a fixed pattern as they are tied to aws account names. Could you please provide an example.? Is .raw equivalent to .keyword.? Can i just just leave as it is to .keyword and change my visualizations from raw to keyword? For reindexing, do i need to fix the mappings first? -- Niraj ---
**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\ **Post date:** [August 30, 2017, 4:21pm UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425/4 "2017-08-30T16:21:03Z")
Use the GET \_template command. You can see here that this template matches everything that comes in, regardless of the index name. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e051a4721977c80989d1d5cb84dc73283c6b9dad.png) Definitely go reads through the documentation if you haven't already. [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2017, 4:21pm UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425/5 "2017-09-27T16:21:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.