# Winlogbeat Mapping Template
**URL:** https://discuss.elastic.co/t/winlogbeat-mapping-template/57554
**Category:** Beats
**Tags:** winlogbeat
**Created:** [August 9, 2016, 6:46am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554 "2016-08-09T06:46:58Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 9, 2016, 6:46am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/1 "2016-08-09T06:46:58Z")
Hi
I am having the following issue [Query Help search for $](https://discuss.elastic.co/t/query-help-search-for/57429)
I have loaded the default winlogbeat template (I'm using v5 Alpha 4 agents)
```auto
{
"mappings": {
"_default_": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": "*"
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"index": "analyzed",
"type": "string"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "winlogbeat-*"
}
```
Any ideas as to what the impact may be to this change ? Or any other work arounds ?
Thanks
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 9, 2016, 9:34pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/2 "2016-08-09T21:34:24Z")
Are you not using the [index template](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html) provided with Winlogbeat? Why? By default the all of the `event_data.*` fields are not\_analyzed strings.
This blog post might be of interest to you based on what you are querying: [Monitoring Windows Logons with Winlogbeat
](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)
---
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 9, 2016, 9:51pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/3 "2016-08-09T21:51:45Z")
As far as I know I am using the index template from winlogbeat, from winlogbeat.template.json (pretty sure this was done to cover another issue I had)
How can I confirm this ?
Thanks
---
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 9, 2016, 9:54pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/4 "2016-08-09T21:54:03Z")
To clarify I'm not loading the index it from the agents, I loaded it at the server side, from memory
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 9, 2016, 10:01pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/5 "2016-08-09T22:01:29Z")
> [@rhyse](#):
>
> How can I confirm this ?
This will return the index template:
`curl http://localhost:9200/_template/winlogbeat?pretty`
This will return the mapping used for today's index. The data types should match whats in the index template.
`curl http://localhost:9200/winlogbeat-2016.08.09/_mapping?pretty`
You can paste the data to [http://pastebin.com](http://pastebin.com) and share the link because it's probably too big to post directly on here.
---
### Author:  [@rhyse](https://discuss.elastic.co/u/rhyse)
#### Post date: [August 10, 2016, 8:08am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/6 "2016-08-10T08:08:45Z")
Ok. I was sure I had loaded that template, but it doesn't look like it was. I have now done so and I am getting better results
Will continue working through my issues.
Sorry for taking up your time
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2016, 8:08am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554/7 "2016-08-31T08:08:49Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.