Osquery exported fields

I'm running 7.16.1 for everything.
including elastic-agent-7.16.1-linux-x86_64.tar.gz

I have a question on osquery exported fields.
From this URL: Osquery Manager | Elastic Docs
It states that fields like
interface_details.ibytes should be mapped as ibytes, "keyword, number.long"

When I imported it via fleet, osquery packs. With a simple
id: interface_details
interval: 60
query: select * from interface_details;

From the kibana gui on the retrieved data.
All the osquery.idrops , ipackets etc are mapped as text fields.

I thought it was suppose to be mapped as number.long?
Or am I missing something?

Regards,

Michael

Sorry.. my mistake.. apparently when you visualise you actually see the value as
osquery.ibytes
osquery.ibytes.number

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.