# Using Doc Values
**URL:** https://discuss.elastic.co/t/using-doc-values/29066
**Category:** Elasticsearch
**Created:** [September 10, 2015, 8:13pm UTC](https://discuss.elastic.co/t/using-doc-values/29066 "2015-09-10T20:13:40Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)
#### Post date: [September 10, 2015, 8:13pm UTC](https://discuss.elastic.co/t/using-doc-values/29066/1 "2015-09-10T20:13:40Z")
Hello,
I am trying to setup Doc values on my active cluster but I am having difficulty understanding how to do this. I've looked over the following articles but still unsure how to accomplish this:
- [https://www.elastic.co/guide/en/elasticsearch/guide/current/doc-values.html#\_enabling\_doc\_values](https://www.elastic.co/guide/en/elasticsearch/guide/current/doc-values.html#_enabling_doc_values)
- [Support in the Wild: My Biggest Elasticsearch Problem at Scale | Elastic Blog](https://www.elastic.co/blog/support-in-the-wild-my-biggest-elasticsearch-problem-at-scale)
The second article says this,
> Updating an Active ClusterNaturally, up to this point, you may be wondering how to remove fielddata from your cluster. The answer depends on your data.
> Time Based IndicesIf you are using time based indices (e.g., logstash-2015.07.18),
> such as with logging use cases, then you should update your template(s)
> to use doc values so that future indices (e.g., tomorrow's) get created
> with doc values. From there, the problem should take care of itself as
> indices that use fielddata will age themselves out.
How do I update the default template to apply doc values for not\_analyzed string fields? Any help would be appreciated.
---
### Author:  [@msimos](https://discuss.elastic.co/u/msimos)
#### Post date: [September 10, 2015, 11:51pm UTC](https://discuss.elastic.co/t/using-doc-values/29066/2 "2015-09-10T23:51:35Z")
Hi,
In your logstash install there is a file called:
```auto
vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.5-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json
```
This is the template which logstash applies if it doesn't find it in Elasticsearch. For any field which is "type": "string" and "index": "not\_analyzed" then you can add "doc\_values": true. You can also apply doc values to any other field type like double, long, etc. so long as the field is not a string and analyzed. For example:
```auto
"@timestamp": {
"type": "date",
"doc_values": true,
"format": "dateOptionalTime"
}
```
Its best to define your fields in your mapping and set doc values for each field. If you're only using dynamic mapping to create your fields then you need to add this into the template. I created one which will automatically apply doc values to any dynamically created field:
>
Its not something I have really tested so you should not put it into production without testing this. Use this as a way to autogenerate your fields when importing some logs so you can build your own template. To add it to Elasticsearch do:
curl -XDELETE [http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash)
curl -XPUT [http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash) -d @template.json
If you encounter any problems you can revert back to the original template by using the above commands and using the template file that comes with logstash.
---
### Author:  [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)
#### Post date: [September 11, 2015, 4:34pm UTC](https://discuss.elastic.co/t/using-doc-values/29066/3 "2015-09-11T16:34:32Z")
Mike, thanks for the detailed response, it's helpful. I think I got it setup correctly. Is there any way to verify it's working besides looking at the results from curl -XGET "[http://localhost:9200/\_template/?pretty=true](http://localhost:9200/_template/?pretty=true)"
Thanks!
---
### Author:  [@msimos](https://discuss.elastic.co/u/msimos)
#### Post date: [September 11, 2015, 4:51pm UTC](https://discuss.elastic.co/t/using-doc-values/29066/4 "2015-09-11T16:51:42Z")
Hi,
Once you added the template, import some log files. Then look at GET logstash-yyyy-mm-dd/\_mapping and in the mapping you should see that doc values were added for your dynamically created fields.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:50pm UTC](https://discuss.elastic.co/t/using-doc-values/29066/5 "2017-07-05T23:50:40Z")