Hello,
I've got an empty dev index that I'm attempting to test some aggregations and a dashboard on. The problem I'm encountering is that when I push logs through to the index via a filebeat collector node the type for my numeric fields is being set to keyword, preventing me from using the "sum" function on the fields in the dashboard. I've since wiped the data and created new fields, explicitly setting their types to "double" and their format to "number" as seen here:
But after pushing log data to the index using this pattern:
The fields are now changed to type keyword and I'm unable to using the functionality that I need on them for my dashboard:
Any help to resolve this would be appreciated. Any work arounds are fine as well as this is just for demonstrative purposes and a new index for will be created to hold this data once it's actually in use.