AH! I only applied my new mappings to the wrong apm indices.
What I had to do was this
PUT apm*/_mapping/
{
"properties": {
"http.request.cookies.LASTSKIN": {
"type": "keyword",
"index": true
},
"http.request.cookies.LASTUSERNAME": {
"type": "keyword",
"index": true
}
}
}
Now it is working for the newly arriving data. So I guess I would have to do a reindex, but that I can do myself.
Thanks for your help!