# Change Default Mapping of String to "Not Analyzed" in Elasticsearch

To change the default mapping of `string` fields to "not analyzed" in Elasticsearch, especially in Elasticsearch 5.x and earlier (when `string` was a field type), you would typically modify the mappings of your indices. In Elasticsearch 6.x and later, `string` fields were replaced by `text` (for analyzed content) and `keyword` (for not-analyzed content). Thus, the approach would differ slightly depending on the Elasticsearch version you're using.

Here’s how you can adjust the default mapping for string (or keyword) fields to be **not analyzed**:

### 1. **Elasticsearch 6.x and Later**

In Elasticsearch 6.x and later, use the `keyword` type to store strings as **not analyzed**. You can define a template or directly set the mapping when creating an index.

### **Using Index Templates**

You can create a template that applies to new indices and sets the string fields as `keyword` (not analyzed) by default.

1. **Create an Index Template**:
    
    This template will apply to any new indices that match the pattern (e.g., `logs-*`).
    
    ```json
    PUT _template/not_analyzed_strings
    {
      "index_patterns": ["logs-*"],
      "mappings": {
        "properties": {
          "your_field": {
            "type": "keyword"
          }
        }
      }
    }
    
    ```
    
    - **`index_patterns`**: Matches the indices where this template will apply (e.g., indices starting with `logs-`).
    - **`type: keyword`**: Ensures the string fields are stored as `keyword`, meaning they will not be analyzed.
2. **Create an Index with This Template**:
    
    After setting up the template, any new index matching the pattern will use this mapping.
    
    ```bash
    PUT logs-2024-09
    ```
    
    Elasticsearch will automatically apply the `keyword` type to the `your_field` field, making it "not analyzed."
    

### **Direct Mapping When Creating an Index**

You can also define the mapping explicitly when creating an index:

```bash
PUT /my_index
{
  "mappings": {
    "properties": {
      "my_string_field": {
        "type": "keyword"
      }
    }
  }
}
```

This will make the `my_string_field` field "not analyzed."

### 2. **Elasticsearch 5.x and Earlier**

In Elasticsearch 5.x, `string` fields could be set as either analyzed or not analyzed. To make a `string` field "not analyzed," you needed to specify the `index: not_analyzed` option in the mapping.

1. **Create an Index Template**:
    
    ```json
    PUT _template/not_analyzed_strings
    {
      "template": "logs-*",
      "mappings": {
        "_default_": {
          "properties": {
            "your_field": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      }
    }
    ```
    
    - **`index: not_analyzed`**: Specifies that the `string` field will be stored as-is and not analyzed.
    - **`template`**: Matches the indices where the template should be applied.
2. **Create the Index**:
    
    When you create an index, Elasticsearch will automatically apply the template and set the `your_field` as "not analyzed."
    
    ```bash
    PUT logs-2024-09
    ```
    

### 3. **Dynamic Template to Apply "Not Analyzed" to All String Fields**

You can also create a **dynamic template** to apply the "not analyzed" setting to all string fields by default.

### **For Elasticsearch 6.x and Later (Using `keyword`)**:

```json
PUT _template/default_template
{
  "index_patterns": ["*"],
  "mappings": {
    "dynamic_templates": [
      {
        "strings_as_keywords": {
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ]
  }
}
```

- **`match_mapping_type: string`**: This ensures that all string fields are matched.
- **`type: keyword`**: Makes all matched fields "not analyzed."

### **For Elasticsearch 5.x and Earlier (Using `not_analyzed`)**:

```json
PUT _template/default_template
{
  "template": "*",
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "strings_as_not_analyzed": {
            "match_mapping_type": "string",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      ]
    }
  }
}
```

This dynamic template ensures that every string field in all indices will be set to "not analyzed."

### Summary

- **For Elasticsearch 6.x and Later**: Use the `keyword` type to store string fields as "not analyzed."
- **For Elasticsearch 5.x and Earlier**: Use the `index: not_analyzed` option for `string` fields.
- **Dynamic Templates**: You can apply a dynamic template to automatically make all string fields "not analyzed" by default.

These methods ensure that string fields are not analyzed by Elasticsearch, allowing you to store and search for exact values rather than full-text analysis.