Message.keyword does not exists

[qsadmin]

Hi,

i have the same problem as in this thread: .keyword doesn't exist

Background: I have updated the elk-stack from version 6.7 to 7. After the update i can not see message.keyword in my index "filebeat-". But at my index "winlogbeat-" there is field message.keyword. I need these field for terms in metrics. Refresh field list did not help.

[tylersmalley]

I am going to move this to the Beats thread - hopefully someone there is better suited to assist with Beats mappings.

[qsadmin]

I am not sure if my problem is a Beats problem. After some additional research i think its belongs to logstash and the default template which logstash load in elasticserch.

[qsadmin]

If i enter the following in the console:

PUT filebeat-7.0.1-2019.05.15
{
"mappings": {
"dynamic_templates": [
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"type": "text",
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
]
}
}

I get the following result:

{
"error": {
"root_cause": [
{
"type": "resource_already_exists_exception",
"reason": "index [filebeat-7.0.1-2019.05.15/88mn-6AbTJe2D0lNVlRIbg] already exists",
"index_uuid": "88mn-6AbTJe2D0lNVlRIbg",
"index": "filebeat-7.0.1-2019.05.15"
}
],
"type": "resource_already_exists_exception",
"reason": "index [filebeat-7.0.1-2019.05.15/88mn-6AbTJe2D0lNVlRIbg] already exists",
"index_uuid": "88mn-6AbTJe2D0lNVlRIbg",
"index": "filebeat-7.0.1-2019.05.15"
},
"status": 400
}

[qsadmin]

solved it with an reindex