I have explained a short version of a much bigger problem.
I have two indices, sam & sam-2.
There is a user field in both indices, sam with mapping type as keyword only...
sam-2 with multiple fields mapping type, text and keyword.
Now, i try to visualize the data with a common index pattern sam* for both indices in DataTable.
For selecting user.keyword as term in bucket-aggregation, I get value of user.keyword displayed for the sam-2,whereas nil for sam.
Both have same number of documents.
Screenshot:
I don't understand, why i get nil for keyword mapping type.
Isn't keyword datatype used for aggregations.