# Various metricbeat example visualizations don't work OOTB, missing .keyword in Group by field? **URL:** \ **Category:** Kibana\ **Created:** [March 15, 2018, 12:47pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101 "2018-03-15T12:47:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![abruening](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@abruening](https://discuss.elastic.co/u/abruening)\ **Post date:** [March 15, 2018, 12:47pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/1 "2018-03-15T12:47:28Z")
I'm using Debian to set up a test system, and the included visualizations, for example "Interfaces by Incoming traffic [Metricbeat System]", show no data by default. I had to set "Group by" to "system.network.name.keyword" instead of just "system.network.name" to show data and couldn't find anything regarding that issue. Is this normal? ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [March 15, 2018, 5:08pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/2 "2018-03-15T17:08:56Z")
That sounds like a bug in how metricbeat sets up the visualizations. I would suggest opening up an issue in the metricbeat github repo. ---
**Author:** ![abruening](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@abruening](https://discuss.elastic.co/u/abruening)\ **Post date:** [March 15, 2018, 5:11pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/3 "2018-03-15T17:11:09Z")
Are you sure? It isn't just Metricbeat, and I couldn't find any mention of system.network.name.keyword in the documentation. ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [March 15, 2018, 5:22pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/4 "2018-03-15T17:22:08Z")
The system.network.name field is being mapped as analyzed, and you can't group on analyzed fields. system.network.name.keyword is the raw not\_analyzed field, and you can group on that. So, you either need to remap/reindex with system.network.name mapped as a keyword field (not\_analyzed), or make the changes you have made above. ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [March 15, 2018, 5:22pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/5 "2018-03-15T17:22:52Z")
This has a pretty good explanation of the difference between analyzed and not\_analyzed: [https://www.elastic.co/guide/en/elasticsearch/guide/current/multi-fields.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/multi-fields.html) ---
**Author:** ![abruening](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@abruening](https://discuss.elastic.co/u/abruening)\ **Post date:** [March 15, 2018, 5:24pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/6 "2018-03-15T17:24:52Z")
Thank you for explaining it, I'll open a bug for Metricbeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 12, 2018, 5:24pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101/7 "2018-04-12T17:24:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.