Hi,
I have 2 fields in my data, one created from LS grok filter and one crated by metribeat.
From LS grok filter: beat.hostname
index is : myindex-*
From metricbeat : beat.hostname
index is : metricbeat-*
Now my challenge is to use this field in one visualization where system matrxi will be shown from both input sources. So that I can group by beat.hostname.
However there is difference.
field created by LS has .keyword (agreeable and searchable)
and the field created by metricbeat does not have .keyword. its only beat.hostname. Since I an select only one field from the term dropdown on time series/guage visual builder, I cant aggregate results from both input sources in one visualization.
How to make those fields compatible so that when I select beat.hostname, it will show me all hosts coming via LS as well as via metricbeat.
br,
Sunil.