Add a new field to the template index and aggregate on it

Elastic Stack Elasticsearch
1

I'm trying to add an additional template to elasticsearch to parse the dns packetbeat. The template adds an additional package analysis field.

-XPUT HTTP://localhost:9200/_template/packetbeat-* -d@packetbeat-dns-template.json

result
{"acknowledged":true}

When you start a kiban and choose a strategy, it determines this field in the list

gjk.png963×131 37.9 KB

But in the future when you visualize and aggregate the records of the table of this field is not in the list.As I understand it, I need to check the aggregation check box, but how do I do this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.