I have logs of a server indexed on my ES. The message body of the logs is in the field named message. Now if I try to aggregate on the field message.keyword. That field doesn't exist for a certain number of logs.
After some research I found that ES maps each string field to two fields. Which in my case should be
But somhow the second field doesn't exist for some logs, although those events have a valid string in their message field. What could be the reason?