Can you maybe tell me what I can do? I changed the above expression slightly. For example, with WORD:student.name I would like to create a field "student" and this field contains the information such as name. In Kibana "discover" I can see the logs, but it shows me that "student.name" is not mapped (Unmapped fields). How do I get that? I described the field under Index Management -> Index Templates -> Settings (from template). Still it doesn't work... 