I have 2 indexes created from 2 seperate templates. I am trying to unify some of the field names/schema.
I have 2 sets of data from 2 sources coming into logstash, I have used mutate and rename to change the name of a field from each source to the same name.
Data from both sources is just text and the templates have the types as text and keyword.
The data comes in, however I find that one of the data sources I can search on and filter on, the other brings up no data if i search or filter, even if in discover I click to filter on the field.
Any suggestions as to what could be happening?