# Original fields name changed to abnormal keyword in new visualization (Kibana)

**URL:** https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227
**Category:** Kibana
**Created:** [July 1, 2019, 5:08am UTC](https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227 "2019-07-01T05:08:41Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![kyaw](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@kyaw](https://discuss.elastic.co/u/kyaw)
#### Post date: [July 1, 2019, 5:08am UTC](https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227/1 "2019-07-01T05:08:41Z")

</div>

When creating a new visualization, original fields name changed to abnormal keywords like.

 ![Screenshot%20(23)](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef1dbb4059a1dbab47d839ffaa167b78d8513ad9.png)

but in raw log json file there is no extra fields name as shown in above figure.

 ![Screenshot%20(24)_LI](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa50b2d9f11c747ecb66a8ce3bbeb4ecba3273f0.jpeg)

Is there anyone who happened like this issue ? Any discussion are welcome and please give me some advice.

---

<div class="post-metadata">

### Author: ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [July 1, 2019, 1:57pm UTC](https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227/2 "2019-07-01T13:57:50Z")

</div>

Hi @kyaw, welcome to the discussion boards!

The `keyword` property is showing up as a result of [Dynamic Mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-mapping.html). This data was indexed into Elasticsearch without an index mapping pre-defined, so Elasticsearch created one for you, based on the [dynamic field mapping rules](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html).

Simple text fields often get index as two separate fields: the original, and `original.keyword`, which contains the same data as the original field, but mapped as a [`keyword`](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html) data type in Elasticsearch. Keywords are typically more useful in Kibana visualizations than their corresponding text fields, but don't benefit from stemming or other analysis features of Elasticsearch.

If you don't want this behavior, then you can create your index mapping before you ingest your data, and explicitly tell Elasticsearch what the index should look like.

---

<div class="post-metadata">

### Author: ![kyaw](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@kyaw](https://discuss.elastic.co/u/kyaw)
#### Post date: [July 2, 2019, 3:26am UTC](https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227/3 "2019-07-02T03:26:13Z")

</div>

@Larry_Gregory Thanks for replying. I know about dynamic mapping.  
As shown in Figure 1, **logs-endpoint-winevent-sysmon-** \* index contains **hostname.keyword** and **event\_id.keyword**....etc. fields name. But suddenly original fields name like **hostname.keyword** or **event\_id.keyword** changed to **A.keyword** , **B.keyword** but in Kibana dashboard still working fine, but I can't create new Dashboard or Visualization because original fields name like \*\* event\_id.keyword" changed to \*\* A.keyword, B.keyword ....etc\*\*.

 ![2019-07-02_095026](https://us1.discourse-cdn.com/elastic/original/3X/1/9/190d99e2d20582c92a14d0227a823a87d66e8fa1.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2019, 3:30am UTC](https://discuss.elastic.co/t/original-fields-name-changed-to-abnormal-keyword-in-new-visualization-kibana/188227/4 "2019-07-30T03:30:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.