Data allways stack in field.keyword than field

Are you using a module that requires a pipeline to be applied?

In the first comment I shared the logstash configuration takes this into consideration