# Unindex fields - how to index this fields

**URL:** https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305
**Category:** Elasticsearch
**Created:** [February 23, 2017, 8:25pm UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305 "2017-02-23T20:25:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Hitman88](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@Hitman88](https://discuss.elastic.co/u/Hitman88)
#### Post date: [February 23, 2017, 8:25pm UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305/1 "2017-02-23T20:25:05Z")

</div>

Hi everybody,

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a5635bd1f323e1073f0bf3b6a3c5fd297f4f5ca5.png)  
newbee question:  
I use grok filtering to parse Cisco syslog file. Has you see in the capture screen i create new field with the end "\_dan" . But thoses fiels are not index. I cannot find the way to index these fields.

Need help how to do it .

Thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 24, 2017, 1:51am UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305/2 "2017-02-24T01:51:31Z")

</div>

What does the mapping for the index look like?

---

<div class="post-metadata">

### Author: ![Hitman88](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@Hitman88](https://discuss.elastic.co/u/Hitman88)
#### Post date: [February 24, 2017, 1:33pm UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305/3 "2017-02-24T13:33:30Z")

</div>

Hi Mark,

Thanks for your reply.

First, i am newbie at this and have poor knowledge on indexing (sorry for that).

I use filebeat to read a syslog file and transfer to logstash.  
In logstash, i use grok for filtering and a pattern file for my \*\_dan fields.

I hope I give you the right info

Here is i think you want

Daniel Trudel

---

<div class="post-metadata">

### Author: ![Hitman88](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@Hitman88](https://discuss.elastic.co/u/Hitman88)
#### Post date: [February 24, 2017, 6:46pm UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305/4 "2017-02-24T18:46:26Z")

</div>

HI found my problem  
Everything is o.k.

need this in logstash conf file "output section"

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
manage\_template =\> false  
index =\> "filebeat-%{+YYYY.MM.dd}"  
document\_type =\> "log"  
}  
stdout { codec =\> rubydebug }  
}

and create the filebeat index :  
curl -XPUT '[http://127.0.0.1:9200/filebeat-2017.02.24](http://127.0.0.1:9200/filebeat-2017.02.24)' -d@/etc/filebeat/filebeat.template.json

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 24, 2017, 6:46pm UTC](https://discuss.elastic.co/t/unindex-fields-how-to-index-this-fields/76305/5 "2017-03-24T18:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.