# Winlogbeat modified to Text and Keyword

**URL:** <https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [January 16, 2018, 4:22pm UTC](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754 "2018-01-16T16:22:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [January 16, 2018, 4:22pm UTC](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754/1 "2018-01-16T16:22:12Z")

</div>

I modified winlogbeat template -  
Current -

```
{
  "winlogbeat-2018.01.02": {
    "mappings": {
      "doc": {
        "event_data.CommandLine": {
          "full_name": "event_data.CommandLine",
          "mapping": {
            "CommandLine": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        }
      }
    }
  }
}

```

to this ...

```
{,
        {
          "event_data": {
            "mapping": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "match_mapping_type": "string",
            "path_match": "event_data.*"
          }
        }

```

and it seemed to work -

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e2bc4f8938ac13daaa3f0a5a8290b007204310d.png)

Text field works and I can run full text searches on everything BUT the keyword field is totally empty...

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [January 16, 2018, 5:11pm UTC](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754/2 "2018-01-16T17:11:37Z")

</div>

Alright correction, the field doesn't work in the 'Discover', but I can do aggregations in Visualize???? No idea what I did...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f3380420a0341b3c8ae5e10a05c4ebf8d26f362.png)

but the field is empty in 'Discover' --  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b830d52520fa853806e1cdaac8d024eb1886bb9.png)

No idea... but appreciate any suggestions.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 16, 2018, 10:32pm UTC](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754/3 "2018-01-16T22:32:25Z")

</div>