Winlogbeat modified to Text and Keyword

Elastic Stack Beats
1

I modified winlogbeat template -
Current -

{
  "winlogbeat-2018.01.02": {
    "mappings": {
      "doc": {
        "event_data.CommandLine": {
          "full_name": "event_data.CommandLine",
          "mapping": {
            "CommandLine": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        }
      }
    }
  }
}

to this ...

{,
        {
          "event_data": {
            "mapping": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "match_mapping_type": "string",
            "path_match": "event_data.*"
          }
        }

and it seemed to work -

image
image.png745×70 5.23 KB

Text field works and I can run full text searches on everything BUT the keyword field is totally empty...

2

Alright correction, the field doesn't work in the 'Discover', but I can do aggregations in Visualize???? No idea what I did...

image
image.png1164×409 36.8 KB

but the field is empty in 'Discover' --
image

No idea... but appreciate any suggestions.