Data Type changes after Lifecycle creation

Good morning,

I have syslog with special fields. These logs are being processed by Elastic-Agent (Filebeat). I created some extra fields in the datastream with numeric data type. These fields are being filled by a KV-processor in the ingest pipeline. All working well.

But after the creation of a new index through the ‘Lifecycle’ policy, the datatype had been changed to ‘keyword’ and aggregation fails.

What’s the problem here?



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.