Transform creating field as keyword instead of text

[kernsb (Brandon Kerns)]

So I have created two Transforms that have a common field of "computer_name", but when creating them one maps the field as text, with a sub keyword field, while the other marks the top field as keyword.

I have created an index template for the latter set as

      "computer_name": {
        "type": "text",
        "fields": {
          "keyword": {
            "ignore_above": 256,
            "type": "keyword"
          }
        }
      },

But on re-creating the transform and index, it is still coming in with 'computer_name' as keyword, ignoring the template.

I need the two to behave the same in searches, so I need for them to match each other. Any advice?

[Hendrik_Muhs]

Hi,

to customize mappings:

• create the transform job without starting it
• create the destination index (note that the _preview endpoint returns the result of mapping deduction, which you can use as template)
• start the transform