Searching logs by host name

Elastic Stack Kibana
5

image
image848×280 23 KB

I can see for some fields Kibana recognizes them as multi-fields, but when I add a host.name.text multi-field, its parent host.name doesn't show up as having a multi-field.

I don't see any real difference in the index mappings:

"process": {
  "properties": {
    "executable": {
      "type": "text",
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 256

v.

"host": {
  "properties": {
    "name": {
      "type": "keyword",
      "fields": {
        "text": {
          "type": "text"