im running elastic 7.6 and kibana 7.6. Im getting logs from my 2 servers tomcat and i use filebeat to send them directly to elasticseach..
doing it i added some custom fields: project
the project field is populated like that (for example):
when i add this on the discovery -> query:
fields.project : "platform-backend"
i expect to see only my logs coming from this tomcat here.... but i see also the logs from the other 2...
the : is an exact match from the docs... what am i doing wrong ?