I'm running a test cluster and a production cluster, metricbeats is one of the things posting data into both of these.
In the metricbeat-* index pattern on my dev cluster the `host` field is searchable and aggregatable but on my production cluster I have a `host` field (searchable and analyzed) and a `host.keyword` (searchable and aggregatable) alongside it. I don't know how that got there, I haven't been messing with the mapping API or the template files.
Because my dev/prod clusters have different fields it's messing up my [ElastAlert](https://github.com/Yelp/elastalert) YAML, one references host and the other needs host.keyword.
Which setup is correct according to MetricBeat defaults and how do I get them in sync?
Then after that completes you delete the metricbeat-2017.01.01 index.
NEW: Monitor These Apps!
Apache Lucene, Apache Solr and all other Apache Software Foundation project and their respective logos are trademarks of the Apache Software Foundation.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries. This site and Sematext Group is in no way affiliated with Elasticsearch BV.
Service operated by Sematext