Term join not yielding results when using Keyword field as left source

[Bustencio]

Hi,

I'm trying to join 2 indexes through term join in Elastic Maps but I'm having trouble retrieving results when I use a "fieldName.keyword" field as the left source of the join, meanwhile I'm not having any trouble retrieving the expected results when assigning the .keyword field value to a scripted field and using that as the left source.

When inspecting the query I can see that the response from the server is the same for both requests.

Included are screenshots from the responses (using both fields as sources) and the scripted field definition so you can see that both fields should have the same information.

• Term join using original field (fieldName.keyword):

• Term join using scripted field:

• Scripted field definition:

I can provide any additional information needed.

Thank you, cheers.

[Nathan_Reese]

It looks like the screen shot for host.keyword response is actually showing the response for scripted field hostname. You can tell by looking at the request description. The left source always says copt-fast-aldi*:hostname. I would expect one to include the text copt-fast-aldi*:host.keyword.

Could you re-post the response for host.keyword?

Thanks

[Bustencio]

My bad, I uploaded the wrong screenshot. Edited the original post to show the right one, sorry!

[Nathan_Reese]

What does the left source look like? Is the left source returning results in both cases. If using a time filter, could you use an absolute time to ensure both cases are comparing the same things?

[Bustencio]

The left source is a network host identifier, in our mapping we have both text field and keyword. I applied an absolute time filter (April 15th 12am - April 22nd 12am) but the output is the same.

This is what the left source looks like under the discover tab with the same filters applied:

This is the mapping: