Praeco does not show .keyword fields on multiple type mappings

[kklmm]

In some cases when creating new rules praeco does not show .keyword fields in the dropdown menu if the field already has a string (or just different) type mapping.

Still trying to replicate exact issue as it does not always bug out.

Choosing incorrect mapping will break the rule from working (will not trigger, will not show visualization graph) In previous versions praeco would auto selected the proper field.

Example when it bugs out index metricbeat-*, timetype default, timestamp @timestamp rule "when average of system.cpu.system.pct grouped by FIELDBELOW" beat.hostname (string) is visible from dropdown menu. -rule will not work beat.hostname.keyword (keyword) not visible - rule will work

Updating the yaml with elastalert api and then refreshing praeco rule will then properly display the new updated field and also trigger the rule.

elastic 7.1.1 praeco v12

[johnsusek]

Interested in this if you can provide an exact reproduce case or more details. Thx for report 👍