Bucket aggregation Terms

[Denis_Vasiliev]

I have an index with keyword field.

{
  "winlogbeat-000011" : {
    "mappings" : {
      "user.name" : {
        "full_name" : "user.name",
        "mapping" : {
          "name" : {
            "type" : "keyword",
            "norms" : true,
            "fields" : {
              "text" : {
                "type" : "text"
              }
            }
          }
        }
      }
    }
  }
}

Despite that fact Kibana only allows me to aggregate on user.name.keywords.

If I use just field user.name it marks it with red and requires to fix errors.

Is this a bug or feature?

ES/Kibana 7.6.0

[Denis_Vasiliev]

Found solution.

If you change field mapping, you have to update index templates.