Beat.name is not a keyword?


(olivier hodac) #1

Hello,

I have seen that beat.name is not a keyword when using the basic mapping. Is it done on purpose?

What is the best practice to allow beat.name to be a keyword? It is very useful to create visualization on beat.name terms


(Andrew Kroh) #2

beat.name is mapped as a keyword in the provided index template. Maybe you didn't install it?

./metricbeat version
metricbeat version 6.5.1 (amd64), libbeat 6.5.1 [b1c6ac83cc037bd75395334eed23b64bd63c87ef built 2018-11-16 01:38:01 +0000 UTC]

./metricbeat export template
...
        "beat": {
          "properties": {
            "hostname": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
...