It sounds like the prod cluster doesn't have the index template installed. The `host` field should be a [keyword datatype]( See [Loading the Index Template in Elasticsearch](

NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB