I'm in position of migrating from former ELK stack to the latest one
So I have 2 environments:
Redis -> Logstash(v1.4.2) -> ES(v1.4.2) -> Kibana(v3.1.0)
Redis -> Logstash(v1.5.2) -> ES(v1.7.1) -> Kibana(v4.0.2)
So I have both ES instances with the duplicate indexes. Now is experimenting with charts.
When I create piechart with Term 'host.raw'(and with 'host' also) it shows all hosts plus domain name as separate field. Please note that it is showing properly in Kibana3.
What am I doing wrong?