I have logs coming from my application, in those logs, there is a "coType" field that used to be a text that contains a keyword subfield.
For a reason that I ignore (I don't think I changed the conf file in months and I reloaded the index in case of an unapplied auto-mapping), the keyword field kind of disappeared but I still receive those logs, the juste now are only text with no subfield.
here's a screenshot of the mapping before and after :
so I was wondering :
- Do you have any idea of the reason why the keyword field could have disappeared ?
- How can I re-add it on my logs ?
Here is my guess for now :
I'm kind of an ELK newbie so I don't know if it can be related but I have a logstash conf that only have a mutate filter to convert some fields to "string", maybe i should had the "coType" field to this filter ?
Thanks for your help !