Unable to build kibana visualization with analyzed fields

[Rupesh_Ranjan]

I am sending metrics via metricbeat and trying to build visualizations in kibana for CPU, RAM usage etc. I can see host field appearing under metricbeat index and able to see that its analyzed. Also, under index pattern, i can see a host.keyword field available.

While trying to build visualizations with host.keyword, its not able to fetch any values, even though it was working a few days before ( i build my index on a daily basis e.g. metricbeat-)

Any idea what would have gone wrong?

P.s. I am running ELK stack version 5.4.0.

[tsvet (p.)]

Hi @Rupesh_Ranjan,
could you please go to Discover and select your ES index and tell us what kind of data you see for host.keyword ?

[Rupesh_Ranjan]

I see host field appearing, but i dont see host.keyword coming up.
The behaviour remains same for the index with which i am able to plot using host.keyword.

[tsvet (p.)]

I am not sure what is your mappig. could you please share it?

Usually if you have such a mapping:
{ "mappings": { "_doc": { "properties": { "my_field": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } } } }
You should:

• Use the my_field field for searches.
• Use the my_field.keyword field for aggregations, sorting, or in scripts.

[Rupesh_Ranjan]

I do see a difference in my mapping for old index and new index.
old mapping:

new mapping:

Can you help me understand how mapping could have changed? Let me know if i missed anything