# Unable to build kibana visualization with analyzed fields **URL:** \ **Category:** Kibana\ **Created:** [March 26, 2018, 7:05am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555 "2018-03-26T07:05:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [March 26, 2018, 7:05am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/1 "2018-03-26T07:05:45Z")
I am sending metrics via metricbeat and trying to build visualizations in kibana for CPU, RAM usage etc. I can see host field appearing under metricbeat index and able to see that its analyzed. Also, under index pattern, i can see a host.keyword field available. While trying to build visualizations with host.keyword, its not able to fetch any values, even though it was working a few days before ( i build my index on a daily basis e.g. metricbeat-) Any idea what would have gone wrong? P.s. I am running ELK stack version 5.4.0. ---
**Author:** ![tsvet](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@tsvet](https://discuss.elastic.co/u/tsvet)\ **Post date:** [March 26, 2018, 7:57am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/2 "2018-03-26T07:57:02Z")
Hi @Rupesh_Ranjan, could you please go to Discover and select your ES index and tell us what kind of data you see for host.keyword ? ---
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [March 26, 2018, 8:11am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/3 "2018-03-26T08:11:08Z")
I see host field appearing, but i dont see host.keyword coming up. The behaviour remains same for the index with which i am able to plot using host.keyword. ---
**Author:** ![tsvet](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@tsvet](https://discuss.elastic.co/u/tsvet)\ **Post date:** [March 26, 2018, 8:57am UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/4 "2018-03-26T08:57:58Z")
I am not sure what is your mappig. could you please share it? Usually if you have such a mapping: `{ "mappings": { "_doc": { "properties": { "my_field": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } } } }` You should: - Use the my\_field field for searches. - Use the my\_field.keyword field for aggregations, sorting, or in scripts. ---
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [March 27, 2018, 5:52pm UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/5 "2018-03-27T17:52:20Z")
I do see a difference in my mapping for old index and new index. old mapping: ![old-mapping](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86bd4538a2169cf6aee4599ece0ab71af29d39f9.png) new mapping: ![new-mapping](https://us1.discourse-cdn.com/elastic/original/3X/3/7/373c990db894519b09c0a4c3941b32e510929554.png) Can you help me understand how mapping could have changed? Let me know if i missed anything ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2018, 5:52pm UTC](https://discuss.elastic.co/t/unable-to-build-kibana-visualization-with-analyzed-fields/125555/6 "2018-04-24T17:52:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.