Data Type changes after Lifecycle creation

Elastic Stack Elasticsearch
1

Good morning,

I have syslog with special fields. These logs are being processed by Elastic-Agent (Filebeat). I created some extra fields in the datastream with numeric data type. These fields are being filled by a KV-processor in the ingest pipeline. All working well.

But after the creation of a new index through the ‘Lifecycle’ policy, the datatype had been changed to ‘keyword’ and aggregation fails.

What’s the problem here?

Thanks,

Herman

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.