I using filebeat via logstash and normaly connect to Elasticsearch. In normal connect is ok but via logstash I have a problem:
Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.hostname] in order to load field data by uninverting the inverted index. Note that this can use significant memory.