I am using logstash to collect some mssql metrics with PerfMon. There is a field called host.raw which seems to auto-generate itself. I have created some visualizations on the kibana and it runs well for the first few days. However, after likely 3 days, the visualization cannot display charts based on the host.raw field. What could be the problem?
Does data exist in the field for newer docs?
Yes. Data still exists. At least when I am not using raw field, i.e. host field, it can display result. However, host is an analyzed field which means kibana will parse them down to separate words when my host name have more than 1 string or when the host name contains - ,thus, the results are not properly displayed. For example, my host is win-7, when I use host field for x axis, it will display 2 column, one win and one 7 instead of a single column win-7. But when I use host.raw, it will only display a single column of win-7 which is then the correct result. However, I can only use host field but not host.raw field now. Therefore, I don't quite understand how this happen