What's the difference between the 'field' and 'field.keyword' fields in Kibana?

Question

When adding a filter in kibana all string fields have a entry and .keyword entry. What is the difference?

Answer 1

to add on to this in case it helps someone is that the .keyword field can be used to create scripted fields on the index if you already have a matching keyword field. Do not need to go through the trouble of switching fielddata to true and reindexing

Answer 2

From elasticsearch 5 there is no string field type, instead there is two types:

Keyword - use it for filter, aggregation and sort.

Text - use it for search text.

When you index documents with string field, for example name, elasticsearch mapping the field to text field for search and to keyword for filter.

Kibana use the field for filter and aggregation, therefore using the keyword.

Look at elasticsearch documentation

Answer 3

In fact, it is not an Kibana issue, it's an ElasticSearch issue which make full-text and keyword search both conformable. The filed.keyword is for keyword search and aggregation, while the original field is used for full-text search.

There is an official blog specialized for this: https://www.elastic.co/cn/blog/strings-are-dead-long-live-strings

There is also a post on the official discuss board, here is the link for your reference: https://discuss.elastic.co/t/why-am-i-getting-keyword-for-my-feilds-in-index-pattern/137983