I'm sorry if I'm hijacking a question but, I'm having an issue with something related to this. I'm using logstash and have the .keyword field but, it's empty and I'd like to visualize on the data. The documentation tells me that via dynamic field mapping a text field with a keyword subfield will be created. That keyword field does not seem to be automatically populated with data like I thought it might?

The only thing I can find on this is [this thread](https://discuss.elastic.co/t/unable-to-query-keyword-fields-from-an-index-created-using-the-default-logstash-template/84185)  which they get off of that topic as it becomes another issue. Is this by design? Should I create a template with a map to get the main fields aggregatable instead because, my data doesn't have a keyword in the source? Logstash seems to be parsing everything correctly based on the pattern/conf which I can paste here if you'd like

Example index

    {
      "logstash-2017.09.05" : {
        "aliases" : { },
        "mappings" : {
          "system_logs" : {
            "_all" : {
              "enabled" : true,
              "norms" : false
            },
            "dynamic_templates" : [
              {
                "message_field" : {
                  "path_match" : "message",
                  "match_mapping_type" : "string",
                  "mapping" : {
                    "norms" : false,
                    "type" : "text"
                  }
                }
              },
              {
                "string_fields" : {
                  "match" : "*",
                  "match_mapping_type" : "string",
                  "mapping" : {
                    "fields" : {
                      "keyword" : {
                        "ignore_above" : 256,
                        "type" : "keyword"
                      }
                    },
                    "norms" : false,
                    "type" : "text"
                  }
                }
              }
            ],
            "properties" : {
              "@timestamp" : {
                "type" : "date",
                "include_in_all" : false
              },
              "@version" : {
                "type" : "keyword",
                "include_in_all" : false
              },
              "action_id" : {
                "type" : "text",
                "norms" : false,
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },

---
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB