Is this by design? Need I create a template with a map to get the main fields aggregatable instead because, my data doesn't have a keyword in the source? Logstash seems to be parsing everything correctly based on the pattern/conf
Wondering if you have any insight for me. If it doesn't work as is plan is to create a template but, I'd like to avoid that if possible because this will be getting data from a lot of different places and if it works using the default that would be great.
Ran a search on the "empty" fields and everything was there
Found this by looking at the available fields and unchecking the "hide missing fields". Then all the .keyword fields were listed and I could click visualize like expected
Hope it helps some other newbie out there
NEW: Monitor These Apps!
Apache Lucene, Apache Solr and all other Apache Software Foundation project and their respective logos are trademarks of the Apache Software Foundation.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries. This site and Sematext Group is in no way affiliated with Elasticsearch BV.
Service operated by Sematext