# Not splitting log data fields into terms (logstash and kibana related questions)

**URL:** <https://discuss.elastic.co/t/not-splitting-log-data-fields-into-terms-logstash-and-kibana-related-questions/15033>\
**Category:** Elasticsearch\
**Created:** [December 27, 2013, 1:11pm UTC](https://discuss.elastic.co/t/not-splitting-log-data-fields-into-terms-logstash-and-kibana-related-questions/15033 "2013-12-27T13:11:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Risto\_Vaarandi](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@Risto\_Vaarandi](https://discuss.elastic.co/u/Risto_Vaarandi)\
**Post date:** [December 27, 2013, 1:11pm UTC](https://discuss.elastic.co/t/not-splitting-log-data-fields-into-terms-logstash-and-kibana-related-questions/15033/1 "2013-12-27T13:11:50Z")

</div>

hi all,  
when log data are stored to elasticsearch, fields are split into terms  
which breaks term panels in Kibana. This issue is not new and has been  
discussed before, and logstash 1.3 has a fix for this:

> **[Logstash 1.3.1 Released!
	  	 | Elastic](https://www.elastic.co/blog/logstash-1-3-1-released)**
>
> Hello friends! We have released logstash 1.3.1 with lots of new fixes and features. You can view the full changelog, but I’d like to highlight two of the new features, both of which were impleme...

Before logstash 1.3 was released, I was using config/default-mapping.json  
file for creating dynamic mappings for some log data fields, for example:

{  
"_default_" : {  
"dynamic\_templates" : [  
{  
"template\_http\_domain" : {  
"match" : "http\_domain",  
"mapping" : {  
"type" : "string",  
"index" : "not\_analyzed"  
}  
}  
},  
...  
...

However, I had issues with this approach, because occasionally (about once  
per 1-2 weeks) the content of this file is ignored, and for some reason,  
older already deleted mappings were activated. For example, in one of the  
configurations from November I was using a mapping for the field  
'wwwdomain' which still gets activated from time to time, although this  
field name has been erased from config/default-mapping.json long ago.  
My first question is: are the old mappings from config/default-mapping.json  
kept in Elasticsearch? If so, is there a way to delete them?

My second question is related to logstash 1.3. I really like the new  
feature for keeping log data fields unsplit. However, unfortunately I am  
not writing into elasticsearch from logstash only, but also using rsyslog  
extensively.  
Does the logstash index template also influence logs data which are written  
into Elasticsearch with rsyslog, provided I am using the same index names  
for both tools?  
(If yes, that would help me to get rid of config/default-mapping.json  
altogether.)

kind regards,  
risto

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/58f87e93-0846-4faa-bb61-9ec3199410e4%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/58f87e93-0846-4faa-bb61-9ec3199410e4%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:59am UTC](https://discuss.elastic.co/t/not-splitting-log-data-fields-into-terms-logstash-and-kibana-related-questions/15033/2 "2017-07-06T01:59:17Z")

</div>