Kibana dashboards and visualizations for auditd module do not use keyword fields for aggregation queries in my version 6.8.4. This is the case for latest upstream too though:
This led to dashboards not working properly since fielddata is disabled by default for text fields. I managed to make them work again, by editing the jsons and using keyword fields.
Is there a reason that upstream uses text fields for aggregation queries ? Does it make sense to send a PR for it?