Hello @Adrian22 ,
the reason why in Investigate you do not see the full list of possible Elastiflow fields is because Elastiflow provides a pre-defined index patterns that is loaded during the setup (https://github.com/robcowart/elastiflow/blob/master/INSTALL.md#kibana-65x-and-later).
Without a pre-built index pattern, both Investigate and Kibana will be able to see only the fields that are effectively present in the mappings when the index pattern is created or refreshed, as returned by the field_caps API. This API cannot see the fields declared in dynamic templates if there are no documents that contain them.
In order to see all the possible Elastiflow fields in Investigate, it would be necessary to convert the files in https://github.com/robcowart/elastiflow/tree/master/kibana into a format suitable for Investigate, which is something we could consider in the future.
Meanwhile, you could still create visualizations from scratch on the fields that are available in your indices, but reusing the standard elastiflow patterns / dashboards / visualizations it won’t be possible without conversion.