Keyword Field Generation

Elastic Stack Kibana
1

Hi All,

I have setup two identical ELK Stacks (in theory) for Dev and Test. We have Metricbeat shipping data into their respective clusters. In our Test environment I've noticed that ".keyword" is being added to the majority of field names when creating visualisations but this has not happened in Dev.

Is there are particular action or setting that causes this to happen? Ideally it would be nice to have consistency across both stacks.

Any help would be really appreciated as I'm not ELK expert.

Thanks, Lee

2

The mappings are not the same, most likely the mapping was not applied to Test ... those .keywords are when the default mapping is used (i.e. no mapping is provided)

Most likely with metricbeat ...
metricbeat setup -e
was not run while pointing to the Test Cluster.

You need to run metribeat setup -e against each cluster at least once.

3

Thank you! I'll give it a try and report back.

4

I think I had a typo, looks like setup was not run on the Test Cluster, (I think I wrote Dev I have since corrected) . You will probably need to cleanup and then run setup.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.