Hi,
i am trying to use an aggregation on a field "roles" which may contain spaces. here is a doc example:
"hits": {
"total": 2539,
"max_score": 1,
"hits": [
{
"_index": "dashboard",
"_type": "logs",
"_id": "AVRcDxUX2_YQvsZKFxeZ",
"_score": 1,
"fields": {
"roles": [
"role customer",
"role vendor"
]
}
}
I reset the mapping of the field "roles" at not_analysed using :
{
"properties": {
"roles": {
"type": "string",
"omit_norms": {
"enabled": true
},
"fielddata": {
"format": "enabled"
},
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
then i sent data using logstash to the field "roles.raw". and then I used an aggregation on the field "roles.raw" which given no result.
here is my mapping for now:
{
"dashboard": {
"mappings": {
"logs": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"email": {
"type": "string"
},
"message": {
"type": "string"
},
"path": {
"type": "string"
},
"referrer": {
"type": "string"
},
"roles": {
"type": "string",
"norms": {
"enabled": false
},
"fielddata": {
"format": "enabled"
},
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}
}
}
Thank you.