How to enable logs being generated with both field and field.keyword on elastic search?

Your post is a little hard to read, it'd be great if you could split the text up to make a little easier to digest :slight_smile:

Are you saying that not all of your fields have a .keyword value? If not can you post the mapping for the index?