# Strange Logstash index fields

**URL:** <https://discuss.elastic.co/t/strange-logstash-index-fields/100689>\
**Category:** Logstash\
**Created:** [September 15, 2017, 1:23pm UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689 "2017-09-15T13:23:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [September 15, 2017, 1:23pm UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689/1 "2017-09-15T13:23:53Z")

</div>

Good morning or afternoon, folks.

I hope I present my issue understandably, and in the right forum.

I'm running Elastic Stack 5.6, and most things are working well. However, when I try to create a Logstash-based visualization in Kibana, and use "Terms" or "Significant Terms" for aggregation, I'm presented with fields in the pick list, which are strange to me. They look like this:

AccountType.keyword  
Action.keyword  
ActivityID.keyword

So, ".keyword" seems to be appended to all of the fields. I see the same fields in the "Index Patterns" in Kibana, and they list as "Aggregatable". But, they don't seem to be.

What am I doing wrong?

Thanks.

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [September 15, 2017, 1:59pm UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689/2 "2017-09-15T13:59:48Z")

</div>

Oh, my config files: [https://pastebin.com/9cmeXGEU](https://pastebin.com/9cmeXGEU)

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [September 16, 2017, 3:02am UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689/3 "2017-09-16T03:02:54Z")

</div>

There is absolutely nothing wrong that you are doing.  
This question should ideally fall under kibana or elasticsearch. The keyword that you see appended is because of something called as analyzers.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html)

Regards,  
N

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [September 16, 2017, 2:20pm UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689/4 "2017-09-16T14:20:27Z")

</div>

Thanks, NerdSec. I'll try in another forum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2017, 2:20pm UTC](https://discuss.elastic.co/t/strange-logstash-index-fields/100689/5 "2017-10-14T14:20:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.