How can I change data type of a field in Filebeat index

Elastic Stack Kibana
1

Hi.I have a string field in my Filebeat index. When I want to make a visualization with that field I cant find it in list of terms. How can I make it aggregatable?

2

Hi @Mahnaz_Haghighi, Welcome to the Elastic Community.

You can come up with custom fields and load in template. Also you can append custom field with custom mapping.

setup.template.overwrite: true
setup.template.append_fields:
- name: test.name
  type: keyword
- name: test.hostname
  type: long
3

tanks a lot. I do it and it works.

1 Like