Shards failed on beat.name with winlogbeat index

[florentmair (Florent)]

Hi

i have an issue with beat.name or beat.hostname value.
If i use beat.name.keyword, I don't have any warning but i have an incomplete graph, i have nothing after the 1rst April
If i use beat.name, i have the warnig with "shards failed" and i have only graph after 1rst April

[florentmair (Florent)]

the mapping in my index have changed

before

 "beat": {
            "properties": {
              "hostname": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              },
              "name": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              },

and now

"beat": {
            "properties": {
              "hostname": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "name": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "version": {
                "type": "keyword",
                "ignore_above": 1024
              }
            }

how is it possible ? how can i repair that ?
i have changed the default compression to "best_compression", is it the cause ?