Host.keyword shows no value

[Stevek (Stefan)]

Hello all,

I am currently struggling to get my host.keyword working for filtering the nodes in dashboard.

From the discovery tab it is visible there are 3 different values within host(image1), but host.keyword only provides one old value(no longer used-image2).

I tried to flush and delete the index in kibana as well with no help.

Have you ever experienced such an issue? Could you help with investigation of why is that happening please?

Thank you in advance,
Stefan

[wylie (Wylie Conlon)]

It sounds like you've made some changes to the indexed data, so first you should verify that the host and host.keyword fields are actually matching. What happens when you run this in dev tools?:

POST myindex/_search
{
  "_source": ["host"],
  "docvalue_fields": ["host.keyword"],
  "size": 500
}

[Stevek (Stefan)]

Yes I did change the input value for host field from my data sources.
I see the old values there for host and host.keyword, not sure why :

"_source" : {
          "host" : "azurewest"
        },
        "fields" : {
          "host.keyword" : [
            "azurewest"

They match, but differs from what my data provides.