# Type keyword stills appearing as text

**URL:** https://discuss.elastic.co/t/type-keyword-stills-appearing-as-text/164334
**Category:** Elasticsearch
**Created:** [January 15, 2019, 3:33pm UTC](https://discuss.elastic.co/t/type-keyword-stills-appearing-as-text/164334 "2019-01-15T15:33:02Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Damian\_Correa](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@Damian\_Correa](https://discuss.elastic.co/u/Damian_Correa)
#### Post date: [January 15, 2019, 3:33pm UTC](https://discuss.elastic.co/t/type-keyword-stills-appearing-as-text/164334/1 "2019-01-15T15:33:02Z")

</div>

Hi guys. I need help.

My goal is to have 2 fields as type "keyword", meaning **no** text type. I want to have these fields like core data, in my case I want this for processid and jobid  
Here is my logstash/conf.d/  
input {  
beats {  
port =\> ####  
}  
}

filter {

```
    grok {
            patterns_dir => "/etc/logstash/patterns/"
            break_on_match => false
            keep_empty_captures => false

            match => { "message" => [ "%{SYSLOGBASE} %{JOBID:jobid} %{PROCESSID:processid} %{GREEDYDATA:syslog_message}"
                                    ]
                     }
        }
           if ![syslog_message] or [syslog_message] == "" { drop {}}

```

}

output {

elasticsearch {  
hosts =\> ["myURLxxxxxx:9200"]  
index =\> "logstash-%{+YYYY.MM.dd}"

}  
#stdout {}  
}

Now here is part of my patterns config

```
                    "logsource": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "text"
                    },
                    "message": {
                        "norms": false,
                        "type": "text"
                    },
                    "offset": {
                        "type": "long"
                    },
                    "processid": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "keyword"
                    },
                    "program": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "text"
                    },
                    "prospector": {
                        "properties": {
                            "type": {
                                "fields": {
                                    "keyword": {
                                        "ignore_above": 256,
                                        "type": "keyword"
                                    }
                                },
                                "norms": false,
                                "type": "text"
                            }
                        }
                    },
"source": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "text"
                    },
                    "syslog_message": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "keyword"
                    },
                    "tags": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "text"
                    },
                    "timestamp": {
                        "fields": {
                            "keyword": {
                                "ignore_above": 256,
                                "type": "keyword"
                            }
                        },
                        "norms": false,
                        "type": "text"
                    }
                }
            }
        }
    }

```

############################  
Here is my template conf.  
{  
"template": "mytemplate",  
"version": "1001",  
"settings": {  
"index.refresh\_interval": "5s"  
},  
"mappings" : {  
"_default_" : {  
"properties" : {  
"jobid" : { "type" : "keyword", "index": "not\_analyzed" },  
"processid" : { "type" : "keyword", "index": "not\_analyzed" },  
"syslog\_message" : { "type" : "keyword", "index": "not\_analyzed" },  
}  
}  
}  
}

```
So as result: by going to kibana > management > elasticSearch Management > select index > "Under Mapping" =
the fields processid and jobid are still present as text.

 "jobid": {
      "type": "text",
      "norms": false,
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 256
        }
      }
    },

```

Here is a sample of core data:

> "pipeline": {  
> "properties": {  
> "batch\_size": {  
> "type": "integer"  
> },  
> "ephemeral\_id": {  
> "type": "keyword"  
> },  
> "format": {  
> "type": "keyword"  
> },  
> "hash": {  
> "type": "keyword"  
> },  
> "id": {  
> "type": "keyword"  
> },  
> "representation": {  
> "type": "object",  
> "enabled": false  
> },  
> "version": {  
> "type": "keyword"  
> },  
> "workers": {  
> "type": "short"  
> }  
> }  
> },

Please help...

---

<div class="post-metadata">

### Author: ![Damian\_Correa](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@Damian\_Correa](https://discuss.elastic.co/u/Damian_Correa)
#### Post date: [January 16, 2019, 3:19pm UTC](https://discuss.elastic.co/t/type-keyword-stills-appearing-as-text/164334/2 "2019-01-16T15:19:01Z")

</div>

Can someone please help 😭

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 13, 2019, 3:19pm UTC](https://discuss.elastic.co/t/type-keyword-stills-appearing-as-text/164334/3 "2019-02-13T15:19:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.