Unable to query .keyword fields from an index created using the default logstash template

Elastic Stack Logstash
6

Thanks for the link Aaron.

After doing some research in the documentation, here is the adapted version of a sample query I use and it's result:

[root@elk-1 ~]# curl localhost:9200/logstash*/logs/_search?pretty -d'
> {
>     "query": {
>         "constant_score" : {
>             "filter" : {
>                 "term" : { "syslog_message.keyword" : "-5-" }
>             }
>         }
>     }
> }'
{
  "took" : 25,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

I've also tried using syslog_message, same result.

I'll update the thread title as this is more a query issue than empty fields.