New version of elk installed: .keyword option is a pain!

We changed our elk stack version from 6.8 to 7.6

Since this, the previous entries are not aggregatables anymore. Can't do sum, hit, top hit, unless I use .keyword parameter added by elastic.

So for an example: before i had parameters.number-of-entries: 17

and now:
parameters.number-of-entries: 17 (not aggregatable)
parameters.number-of-entries.keyword :17 (aggregatable)

And this for a number of indices of 900!

So we have to change all our visualise saved items.

Adding to this, as it's a new field, means using more field in kibana and elastic searches, increasing field limit to a higher score

My question: how can I remove .keyword and make aggregatable the basic parameter?

I want to do this automatically for all entries incoming next days, dont want to do change for all fields every day..

Shal I use template? how?

Thanks for your advices
Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.