Keyword is empty

[dgomezan (David Gomez)]

I have defined a new mapping on a type of document (log) as follows:

{
  "mapping": {
    "log": {
      "properties": {
        "requested_uri": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

But after adding some documents, I can see the field requested_uri with data, but the field requested_uri.keyword is empty. Could you please tell what is missing or what am I doing wrong?
In DIscover I see these documents with requestes_uri.keyword empty, but when I create a new chart in Visualize, it's working fine. Is there a way to see what is in this field in Discover?

[dadoonet (David Pilato)]

You are doing nothing wrong. I guess you are speaking about the fact that requested_uri.keyword is not part of the _source field. This is expected.
Elasticsearch does not modify what you are sending and stores the json content as is within _source.
But it generates the requested_uri.keyword field at index time in the inverted index.

So if you run a terms agg on that field you will probably see that it's populated actually.