There is a field (_path) in my Kibana Discovery tab which shows up as unknown type (?) yet it is listed in my dynamic template mapping as "keyword". Everything else in the template works great.
The data in _path is simply the name of a Zeek log. I.e. conn, dns, etc.
Can anyone explain how to get _path to show up as keyword instead of unknown? I've also tried making the type "text" as well but that didn't work either.
Thanks ahead of time!
"logstash-2019.10.08": {
- "mappings": {
- "dynamic_templates": [
- {
- "message_field": {
- "path_match": "message",
- "match_mapping_type": "string",
- "mapping": {
- "norms": false,
- "type": "text"}}}
, * {
- "string_fields": {
- "match": "*",
- "match_mapping_type": "string",
- "mapping": {
- "fields": {
- "keyword": {
- "ignore_above": 256,
- "type": "keyword"}},
- "keyword": {
- "norms": false,
- "type": "text"}}}],
- "fields": {
- "message_field": {
- {
- "properties": {
- "@timestamp": {
- "type": "date"},
- "@version": {
- "type": "keyword"},
- "_path": {
- "type": "keyword"},
- "@timestamp": {
- "dynamic_templates": [