Its recommended to use always the.keyword because every value which is not a .keyword must be loaded into RAM which slow down your ELK-Stack´s performance if you do not have much RAM. If you use the field without .keyword you must activate the fielddata for this field. (You can make this with a PUT-Message)
If you have Kibana 6.x please type in your script in the developer-console and let you give the result for the normal field (non-scripted). I think your field is containing non-numeric data so painless will fail to convert it.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.