Hi All,
I changed the index mapping for my index, and now I can't perform visualisations on the fields!
Example index template:
PUT /_template/my_logstash
{
"order": 1000,
"index_patterns": [
"logstash-*",
"docker-*",
"syslog-*",
"ironport-*",
"radius-*",
"firewall-*"
],
"settings": {
"analysis": {
"analyzer": {
"keyword_lowercase": {
"tokenizer": "keyword",
"filter": ["lowercase"]
},
"whitespace_lowercase": {
"tokenizer": "whitespace",
"filter": ["lowercase"]
}
}
}
},
"mappings": {
"doc": {
"dynamic": "true",
"properties": {
"bytes": {
"type": "integer"
},
"bytes_in": {
"type": "integer"
},
"dest_ip": {
"type": "ip"
},
"src_ip": {
"type": "ip"
},
"host": {
"type": "text",
"analyzer": "whitespace_lowercase"
},
"logsource": {
"type": "text",
"analyzer": "whitespace_lowercase"
},
"program": {
"type": "text",
"analyzer": "whitespace_lowercase"
},
<TRUNCATED>
But on newly created indexes (and recent data into existing indexes) I can no longer use the host 'field' to split data etc.
Looking at a newly created index (with data), the 'host' field exists in the documents, and in Kibana, but in Kibana's index-patterns 'host' is searchable ONLY.
There is no 'host.keyword' like their used to be....
What can I do to fix this?