Data allways stack in field.keyword than field

[stephenb (Stephen Brown)]

@JLeysens @Dreinale

Actually if you are using modules + logstash + datastreams + 8.x the output is a little different our docs are wrong and there is a tiny bug

Please look at this thread

Only write ops with an op_type of create are allowed in data streams"}}}}

Try this there is an error in the docs... Clean up the data stream and try again... output { if [@metadata][pipeline] { elasticsearch { hosts => "http://localhost:9200" pipeline => "%{[@metadata][pipeline]}" user => "elastic" password => "password" manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}" action => "create" } } else { elasticsearch { hosts => "http://localhost:9200" user => "elastic" …

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      pipeline => "%{[@metadata][pipeline]}"
      user => "elastic"
      password => "password"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      action => "create" <!--- Important
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      user => "elastic"
      password => "password"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      action => "create"
    }
  }
} 

I think I explain why somewhere in there...