Recently I have faced a strange problem and trying to figure out the root cause of that.
Logstash was creating indices in ES where all string fields were not analyzed(all other days we have it all analyzed always and we use raw fields in Kibana).
So at some point Kibana was not finding a data since raw fields were missing,
Next day it went back to normal and all string fields are analyzed again,
My question is, what could cause ES to stop analyzing fields in documents coming from Logstash?
I would like to prevent this from happening.