I migrated my elasticsearch to another cluster.
I did exported all Saved Objects from the older cluster and imported in the new cluster.
I "dumped" an rollup job index from the previous cluster to the new one.
The problem is that on the new cluster, the dashboards that was working on the older, are not working anymore.
This is the dashboard error:
As I said, I did a dump from the index and the Saved objects (including the dataview used by this dashboard), so It was supposed to has no difference.
But if I edit the dashboard, I can see that the cause of the error is that the field that I used is now missing:
But ok, if I change the field to use other with same name but with the suffix ".keyword", now the error is other:
This is the request the dashboard is running:
{
"aggs": {
"0": {
"terms": {
"field": "nomeIntegrador.keyword.terms.value.keyword",
"order": {
"2": "desc"
},
"size": 10,
"shard_size": 25
},
"aggs": {
"1": {
"terms": {
"field": "nomeIntegrador.keyword.terms.value.keyword",
"order": {
"2": "desc"
},
"size": 3,
"shard_size": 25
},
"aggs": {
"2": {
"sum": {
"field": "@timestamp.date_histogram._count"
}
}
}
},
"2": {
"sum": {
"field": "@timestamp.date_histogram._count"
}
}
}
}
},
"size": 0,
"fields": [],
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"range": {
"@timestamp.date_histogram.timestamp": {
"format": null,
"gte": 2024,
"lte": 2024
}
}
}
],
"should": [],
"must_not": []
}
}
}
I don't know, but I suspect that the problem now is that the filter range format is null.
Anyway, do you guys have any idea what is going on?
Why the field is different now and has a suffix ".keyword" at the end?