I have setup two identical ELK Stacks (in theory) for Dev and Test. We have Metricbeat shipping data into their respective clusters. In our Test environment I've noticed that ".keyword" is being added to the majority of field names when creating visualisations but this has not happened in Dev.
Is there are particular action or setting that causes this to happen? Ideally it would be nice to have consistency across both stacks.
Any help would be really appreciated as I'm not ELK expert.