I’m running Elasticsearch version 8.8.0, and I want to map source.as.organization.name and destination.as.organization.name as keyword fields. This is data sent to ES using Filebeat, that is automatically getting IP geoloc enriched.

The relevant portion of my index mapping is as follows.

"source": {
  "type": "object",
  "properties": {
    "as": {
      "type": "object",
      "properties": {
        "number": {
          "type": "integer"
        },
        "organization": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        }
      }
    },
    ...
"destination": {
  "type": "object",
  "properties": {
    "as": {
      "type": "object",
      "properties": {
        "number": {
          "type": "integer"
        },
        "organization": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        }
      }
    },
...

When I check the “Index Templates” page on Kibana, the mapping for both fields are displayed as Keyword. However, when I looked at the records, both fields are still displayed with the t icon next to it, indicating they are text fields.

Why are the fields still stored as text fields, and how can I store them as keyword fields instead?