diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
index d063ebe92f9387..029e278b5aa93c 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
@@ -40,7 +40,7 @@ exports[`creating index patterns from yaml fields createIndexPattern function cr
 {
   "title": "logs-*",
   "timeFieldName": "@timestamp",
-  "fields": "[{\\"name\\":\\"coredns.id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.allParams\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.length\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.size\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.class\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.query.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.query.type\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.flags\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.size\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.dnssec_ok\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"boolean\\"},{\\"name\\":\\"@timestamp\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"date\\"},{\\"name\\":\\"labels\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"message\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"tags\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.ephemeral_id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.type\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.version\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"as.number\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"as.organization.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"nginx.access.remote_ip_list\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.body_sent.bytes\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.method\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.url\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.http_version\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.response_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.referrer\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.agent\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_agent.device\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_agent.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_agent.os\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_agent.os_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.user_agent.original\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.geoip.continent_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"nginx.access.geoip.country_iso_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.geoip.location\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.geoip.region_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.geoip.city_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"nginx.access.geoip.region_iso_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true},{\\"name\\":\\"source.geo.continent_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country.keyword\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country.text\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"type\\":\\"string\\"}]",
+  "fields": "[{\\"name\\":\\"coredns.id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.allParams\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.length\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.size\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.query.class\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.query.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.query.type\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.flags\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"coredns.response.size\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"coredns.dnssec_ok\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"boolean\\"},{\\"name\\":\\"@timestamp\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"date\\"},{\\"name\\":\\"labels\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"message\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"tags\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.ephemeral_id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.id\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.type\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"agent.version\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"as.number\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"number\\"},{\\"name\\":\\"as.organization.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"nginx.access.remote_ip_list\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.body_sent.bytes\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.method\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.url\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.http_version\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.response_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.referrer\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.agent\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_agent.device\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_agent.name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_agent.os\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_agent.os_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.user_agent.original\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.geoip.continent_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"nginx.access.geoip.country_iso_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.geoip.location\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.geoip.region_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.geoip.city_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"nginx.access.geoip.region_iso_code\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true},{\\"name\\":\\"source.geo.continent_name\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country.keyword\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":true,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"},{\\"name\\":\\"country.text\\",\\"count\\":0,\\"scripted\\":false,\\"indexed\\":true,\\"analyzed\\":false,\\"searchable\\":true,\\"aggregatable\\":false,\\"doc_values\\":true,\\"readFromDocValues\\":true,\\"type\\":\\"string\\"}]",
   "fieldFormatMap": "{\\"coredns.allParams\\":{\\"id\\":\\"bytes\\",\\"params\\":{\\"pattern\\":\\"patternValQueryWeight\\",\\"inputFormat\\":\\"inputFormatVal,\\",\\"outputFormat\\":\\"outputFormalVal,\\",\\"outputPrecision\\":\\"3,\\",\\"labelTemplate\\":\\"labelTemplateVal,\\",\\"urlTemplate\\":\\"urlTemplateVal,\\"}},\\"coredns.query.length\\":{\\"params\\":{\\"pattern\\":\\"patternValQueryLength\\"}},\\"coredns.query.size\\":{\\"id\\":\\"bytes\\",\\"params\\":{\\"pattern\\":\\"patternValQuerySize\\"}},\\"coredns.response.size\\":{\\"id\\":\\"bytes\\"}}"
 }
 `;
@@ -57,6 +57,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -68,6 +69,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "number"
     },
     {
@@ -79,6 +81,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "number"
     },
     {
@@ -90,6 +93,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "number"
     },
     {
@@ -101,6 +105,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -112,6 +117,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -123,6 +129,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -134,6 +141,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -145,6 +153,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -156,6 +165,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "number"
     },
     {
@@ -167,6 +177,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "boolean"
     },
     {
@@ -178,6 +189,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "date"
     },
     {
@@ -188,7 +200,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "message",
@@ -199,6 +212,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": false,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -210,6 +224,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -221,6 +236,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -232,6 +248,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -243,6 +260,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -254,6 +272,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -265,6 +284,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -276,6 +296,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "number"
     },
     {
@@ -287,6 +308,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -297,7 +319,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.body_sent.bytes",
@@ -307,7 +330,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_name",
@@ -317,7 +341,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.method",
@@ -327,7 +352,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.url",
@@ -337,7 +363,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.http_version",
@@ -347,7 +374,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.response_code",
@@ -357,7 +385,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.referrer",
@@ -367,7 +396,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.agent",
@@ -377,7 +407,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_agent.device",
@@ -387,7 +418,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_agent.name",
@@ -397,7 +429,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_agent.os",
@@ -407,7 +440,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_agent.os_name",
@@ -417,7 +451,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.user_agent.original",
@@ -427,7 +462,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.geoip.continent_name",
@@ -438,6 +474,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": false,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -448,7 +485,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.geoip.location",
@@ -458,7 +496,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.geoip.region_name",
@@ -468,7 +507,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.geoip.city_name",
@@ -478,7 +518,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "nginx.access.geoip.region_iso_code",
@@ -488,7 +529,8 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "analyzed": false,
       "searchable": true,
       "aggregatable": true,
-      "doc_values": true
+      "doc_values": true,
+      "readFromDocValues": true
     },
     {
       "name": "source.geo.continent_name",
@@ -499,6 +541,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": false,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -510,6 +553,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -521,6 +565,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": true,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     },
     {
@@ -532,6 +577,7 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
       "searchable": true,
       "aggregatable": false,
       "doc_values": true,
+      "readFromDocValues": true,
       "type": "string"
     }
   ],