Aggregating fields without indexing it

Elastic Stack Elasticsearch
1

Hi all,
Trying to follow the example from here, I marked all of the fields as not indexed - but supposibly they should be aggregate-able.
According to Kibana over the same fields, they are not.
Looking into a solution, enabling doc_values suppose to do it - but seems like it does not work, and the dynamic field created does not have the doc_values enabled.

Meanwhile it seems I must enable indexing for all fields in order to aggregate.
Is this a known issue ?
I am working on ES 5.

Thanks in advance,
Shushu

2

I just tried this using elasticsearch directly:

DELETE test
PUT test
{
   "settings": {
	  "number_of_replicas": 0,
	  "number_of_shards":1
   },
   "mappings": {
	  "test": {
				
		 "properties": {
			"longField": {
			   "type": "long",
				"index":false
			 }
		 }
	  }
   }
}
POST test/test
{
	"longField":12
}
GET test/_search
{
	"aggs":{
		"longs":{
			"sum":{
				"field":"longField"
			}
		}
	}
}

Elasticsearch correctly produces an aggregation because doc_values are available (setting doc_values explicitly to false in the mapping breaks this).
I tried pointing Kibana at the same index and as you suggest it failed to recognise this as an aggregatable field. I suggest you raise this in the Kibana forum as that seems to be where the issue is.

1 Like
3

OK there is an issue here with the metadata elasticsearch provides to Kibana to determine what is aggregatable. The api Kibana uses [1] currently only returns "isAggregatable" info on indexed fields.
We'll take a closer look on how to address this but for now to work with Kibana it looks like the worka-around is you'll need indexed fields (with the baggage that incurs).

[1] https://www.elastic.co/guide/en/elasticsearch/reference/5.0/search-field-stats.html

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.