Im using 7.5.2 across the board. I installed the auditbeat vis and dashboards but when I go to the 'logins' view I get a message
Fielddata is disabled on text fields by default. Set fielddata=true on [event.action] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
So I get the auditbeat 7.5.2 template and look at the properties for 'event.action' . First I notice that its already a 'keyword' field. Mmmk. So I try to add 'fieldata':'true' and Im told
"reason": "Failed to parse mapping [_doc]: Mapping definition for [action] has unsupported parameters: [fielddata : true]",
Seems like a disconnect here. How do I rectify this?