What's the difference between the 'field' and 'field.keyword' fields in Kibana?

Question

When adding a filter in kibana all string fields have a entry and .keyword entry. What is the difference?

Answer 1

From elasticsearch 5 there is no string field type, instead there is two types:

Keyword - use it for filter, aggregation and sort.

Text - use it for search text.

When you index documents with string field, for example name, elasticsearch mapping the field to text field for search and to keyword for filter.

Kibana use the field for filter and aggregation, therefore using the keyword.

Look at elasticsearch documentation