When importing new version fields do not map correctly

[bennerj]

I have noticed that when I have switched from v24 to v25 and uploaded the new ndjson file several of the visualizations no longer work.

This requires me to go in and update the field in each and change from what it was to same name with just .keyword at the end.

Example is the event.dataset: notice AND network.transport: icmp visualization is looking for notice.message and that is not found. Switching that to notice.message.keyword the visualization then starts working.

[hunter32me]

Quick question are you using the Logstash pipeline or Ingest pipeline

[bennerj]

Logstash pipeline