painless: doc['field'] vs doc['field.keyword']

 doc['field'] are enable by default on all fields EXCEPT text fields.

doc['field.keyword'] 

- populate not while ingesting, but a bit later
- by default only populate if length < 256

painless (elasticsearch)

To check is field exist:
if (doc['alert.metadata.direction.keyword'].size()!=0){
  // do something
}

or
if (!doc['alert.metadata.direction.keyword'].empty){
  // do something
}