# Aggregation & not\_analysed

**URL:** <https://discuss.elastic.co/t/aggregation-not-analysed/48655>\
**Category:** Elasticsearch\
**Created:** [April 28, 2016, 9:09am UTC](https://discuss.elastic.co/t/aggregation-not-analysed/48655 "2016-04-28T09:09:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![maher](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@maher](https://discuss.elastic.co/u/maher)\
**Post date:** [April 28, 2016, 9:09am UTC](https://discuss.elastic.co/t/aggregation-not-analysed/48655/1 "2016-04-28T09:09:14Z")

</div>

Hi,  
i am trying to use an aggregation on a field "roles" which may contain spaces. here is a doc example:

"hits": {  
"total": 2539,  
"max\_score": 1,  
"hits": [  
{  
"\_index": "dashboard",  
"\_type": "logs",  
"\_id": "AVRcDxUX2\_YQvsZKFxeZ",  
"\_score": 1,  
"fields": {  
"roles": [  
"role customer",  
"role vendor"  
]  
}  
}  
I reset the mapping of the field "roles" at not\_analysed using :

{  
"properties": {  
"roles": {  
"type": "string",  
"omit\_norms": {  
"enabled": true  
},  
"fielddata": {  
"format": "enabled"  
},  
"fields": {  
"raw": {  
"type": "string",  
"index": "not\_analyzed"  
}  
}  
}  
}  
}  
then i sent data using logstash to the field "roles.raw". and then I used an aggregation on the field "roles.raw" which given no result.

here is my mapping for now:

{  
"dashboard": {  
"mappings": {  
"logs": {  
"properties": {  
"@timestamp": {  
"type": "date",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
},  
"email": {  
"type": "string"  
},  
"message": {  
"type": "string"  
},  
"path": {  
"type": "string"  
},  
"referrer": {  
"type": "string"  
},  
"roles": {  
"type": "string",  
"norms": {  
"enabled": false  
},  
"fielddata": {  
"format": "enabled"  
},  
"fields": {  
"raw": {  
"type": "string",  
"index": "not\_analyzed"  
}  
}  
}  
}  
}  
}  
}  
}

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:55pm UTC](https://discuss.elastic.co/t/aggregation-not-analysed/48655/2 "2017-07-05T22:55:36Z")

</div>

Closed on July 5, 2017, 10:55pm UTC