Auditd module's kibana dashboards do not use keyword fields

Kibana dashboards and visualizations for auditd module do not use keyword fields for aggregation queries in my version 6.8.4. This is the case for latest upstream too though:

This led to dashboards not working properly since fielddata is disabled by default for text fields. I managed to make them work again, by editing the jsons and using keyword fields.

Is there a reason that upstream uses text fields for aggregation queries ? Does it make sense to send a PR for it?

Thank you,

What specific fields are seeing indexed as text? Most things are keyword, but there are a few places where multi-fields have been used to index both as keyword and text.

Maybe you don't have the Auditbeat index template installed?

Ah yeah, that could be it, thanks! If Elasticsearch has already loaded documents,I guess I can load the template retroactively then, and Kibana will honor the new new template for new index documents? Is that right?

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.