I am trying to push SNMP trap output field of logstash to elastic. It is pushing as "text" type. I understand that "string" type data will be pushed as "text". I want it to be as "keyword" type to do some analytics on the data. I tried to change the data type with dynamic_template, but it is still coming as "text" type. Here is the link for reference:
And here is the Index file and output:
I want "IF-MIB::ifAdminStatus" in "keyword" type. Please suggest some way to change the data type of field.