I seem to be having an issue with mapping in my template. I have a field with data type "text", when I look into the Kibana SIEM console I receive the following error for several of my fields:
[illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
However when I look up one of these fields I see that I have a keyword field mapped to each "text" type
Exactly where do I need to add the type:keyword to resolve this?