Comparing text between .raw and .keyword

Elastic Stack Elasticsearch
1

Hi,

I'm working on an aggregation of Queue statistics data. The data that I'm feeding in is from a log file that filebeat sends to and ingestion pipeline. The field queue, is a text field that comes in and gets assigned queue.raw for use in visualizations. I have created an aggregation script that builds a new index based on aggregating the queue data by hour, day, or whatever. However, that data when visualizing it shows up with queue.keyword.
I created an index alias so I can pull both the current and aggregate data together for a single visualization.
For example, I look at the MAX queue depth over time by queue. But the Aggregate uses queue.keyword and the real time data uses queue.raw. So how do I fix this so they will both have the same field suffix?

Thanks,
Tim

2

I think my filebeat ingest templates are old. I forced an update to them and will check the next day to see if this brings them up to the new way of doing .keyword instead of .raw.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.