Fielddata is disabled, but I have added a keyword field

Which version of Auditbeat?

I mean that when I'm using Auditbeat with all the default values, that I set up auditbeat as written in the documentation, it installs everything for me, including the right templates for auditbeat.