elastic · ycombinator · Jan 24, 2019 · Jan 23, 2019 · Jan 24, 2019 · ruflin
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -115,6 +115,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Support haproxy log lines without captured headers. {issue}9463[9463] {pull}9958[9958]
 - Make elasticsearch/audit fileset be more lenient in parsing node name. {issue}10035[10035] {pull}10135[10135]
 - Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211]
+- Fixed data types for roles and indices fields in `elasticsearch/audit` fileset {pull}10307[10307]
 
 *Heartbeat*
 
@@ -127,6 +128,10 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix panics in vsphere module when certain values where not returned by the API. {pull}9784[9784]
 - Fix pod UID metadata enrichment in Kubernetes module. {pull}10081[10081]
 - Fix issue that would prevent collection of processes without command line on Windows. {pull}10196[10196]
+- Fixed data type for tags field in `docker/container` metricset {pull}10307[10307]
+- Fixed data type for tags field in `docker/image` metricset {pull}10307[10307]
+- Fixed data type for isr field in `kafka/partition` metricset {pull}10307[10307]
+- Fixed data types for various hosts fields in `mongodb/replstatus` metricset {pull}10307[10307]
 
 *Packetbeat*
 

diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -3956,7 +3956,7 @@ The authentication realm
 *`elasticsearch.audit.roles`*::
 +
 --
-type: array
+type: keyword
 
 example: ['kibana_user', 'beats_admin']
 
@@ -3978,7 +3978,7 @@ The name of the action that was executed
 *`elasticsearch.audit.indices`*::
 +
 --
-type: array
+type: keyword
 
 example: ['foo-2019.01.04', 'foo-2019.01.03', 'foo-2019.01.06']
 

@@ -17,15 +17,15 @@
     - name: roles
       description: "Roles to which the principal belongs"
       example: [ "kibana_user", "beats_admin" ]
-      type: array
+      type: keyword
     - name: action
       description: "The name of the action that was executed"
       example: "cluster:monitor/main"
       type: keyword
     - name: indices
       description: "Indices accessed by action"
       example: [ "foo-2019.01.04", "foo-2019.01.03", "foo-2019.01.06" ]
-      type: array
+      type: keyword
     - name: request
       description: "The type of request that was executed"
       example: "ClearScrollRequest"

diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc
@@ -2687,7 +2687,7 @@ Size of the files that have been created or changed since creation.
 *`docker.container.tags`*::
 +
 --
-type: array
+type: keyword
 
 Image tags.
 
@@ -3206,7 +3206,7 @@ Image labels.
 *`docker.image.tags`*::
 +
 --
-type: array
+type: keyword
 
 Image tags.
 
@@ -10508,7 +10508,7 @@ Leader id (broker).
 *`kafka.partition.partition.isr`*::
 +
 --
-type: array
+type: keyword
 
 List of isr ids.
 
@@ -14860,7 +14860,7 @@ Optime of primary
 *`mongodb.replstatus.members.secondary.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of secondary hosts
 
@@ -14887,7 +14887,7 @@ type: long
 *`mongodb.replstatus.members.recovering.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of recovering members hosts
 
@@ -14907,7 +14907,7 @@ Count of members in the `recovering` state
 *`mongodb.replstatus.members.unknown.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of members' hosts in the `unknown` state
 
@@ -14927,7 +14927,7 @@ Count of members with `unknown` state
 *`mongodb.replstatus.members.startup2.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of initializing members hosts
 
@@ -14947,7 +14947,7 @@ Count of members in the `startup2` state
 *`mongodb.replstatus.members.arbiter.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of arbiters hosts
 
@@ -14967,7 +14967,7 @@ Count of arbiters
 *`mongodb.replstatus.members.down.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of `down` members hosts
 
@@ -14987,7 +14987,7 @@ Count of `down` members
 *`mongodb.replstatus.members.rollback.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of members in the `rollback` state
 
@@ -15007,7 +15007,7 @@ Count of members in the `rollback` state
 *`mongodb.replstatus.members.unhealthy.hosts`*::
 +
 --
-type: array
+type: keyword
 
 List of members' hosts with healthy = false
 

diff --git a/metricbeat/module/docker/container/_meta/fields.yml b/metricbeat/module/docker/container/_meta/fields.yml
@@ -34,6 +34,6 @@
           description: >
              Size of the files that have been created or changed since creation.
     - name: tags
-      type: array
+      type: keyword
       description: >
         Image tags.
diff --git a/metricbeat/module/docker/fields.go b/metricbeat/module/docker/fields.go
diff --git a/metricbeat/module/docker/image/_meta/fields.yml b/metricbeat/module/docker/image/_meta/fields.yml
@@ -42,6 +42,6 @@
         Image labels.
 
     - name: tags
-      type: array
+      type: keyword
       description: >
         Image tags.
diff --git a/metricbeat/module/kafka/fields.go b/metricbeat/module/kafka/fields.go
diff --git a/metricbeat/module/kafka/partition/_meta/fields.yml b/metricbeat/module/kafka/partition/_meta/fields.yml
@@ -34,7 +34,7 @@
           description: >
             Leader id (broker).
         - name: isr
-          type: array
+          type: keyword
           description: >
             List of isr ids.
         - name: replica