Aligning array elements with parent in table visualization

Elastic Stack Kibana
1

I'm trying to create a table visualization in Kibana. My data structure is like this:
Vehicle{
Vehicle Number
Vehicle make
Vehicle model
Vehicle year}

Each record can have multiple vehicles in it, so the parent Vehicle data element is an array. The problem I have is that if I try to output the data into a table visualization, kibana combines each element with each possible other element, rather than only displaying information relevant to each vehicle. So, if I have one vehicle in the record, it works flawlessly. But then for records with multiple vehicles, I see duplication of data.

For example: a record has 2 vehicles in it. 2006 Toyota Corrola and 2010 Ford Taurus. I want to see the following table, two lines only.

Year Make Model
2006 Toyota Corrola
2010 Ford Taurus

But what I actually get is:
Year Make Model
2006 Toyota Corrola
2006 Toyota Taurus
2006 Ford Corrola
2006 Ford Taurus
2010 Toyota Corrola
2010 Toyota Taurus
2010 Ford Corrola
2010 Ford Taurus

Does anybody know what I might need to do to get each line in the table to only show information relevant to the array it is part of? I have to imagine it's simple, I'm just not finding what it could be.

2

Can you please check if the field type is mapped as "nested" in elasticsearch?

An example of nested mapping:

Using nested:

PUT /people_index
{
  "mappings": {
    "properties": {
      "name": { "type": "keyword" },
      "age": { "type": "integer" },
      "vehicles": {
        "type": "nested",
        "properties": {
          "vehicleNumber": { "type": "keyword" },
          "vehicleMake": { "type": "keyword" },
          "vehicleModel": { "type": "keyword" },
          "vehicleYear": { "type": "integer" }
        }
      }
    }
  }
}

Data indexed with nested:

POST /people_index/_doc/1
{
  "name": "John",
  "age": 30,
  "vehicles": [
    {
      "vehicleNumber": "ABC123",
      "vehicleMake": "Toyota",
      "vehicleModel": "Corolla",
      "vehicleYear": 2006
    },
    {
      "vehicleNumber": "XYZ789",
      "vehicleMake": "Ford",
      "vehicleModel": "Taurus",
      "vehicleYear": 2010
    }
  ]
}

Mapping without nested:

PUT /people_index
{
  "mappings": {
    "properties": {
      "name": { "type": "keyword" },
      "age": { "type": "integer" },
      "vehicles": {
        "type": "keyword"
      }
    }
  }
}

Data without nested:

POST /people_index/_doc/1
{
  "name": "John",
  "age": 30,
  "vehicles": ["ABC123", "Toyota", "Corolla", 2006, "XYZ789", "Ford", "Taurus", 2010]
}

I may be wrong but please give it a shot. Thanks.

1 Like
3

Thanks so much for responding! There are a lot of extra fields so I'm just going to extract a couple fields from the vehicles, but it looks like this:

...
  "vehicles": [
	{
	  "vehicleNumber": 1,	
		"vehicleMake": {
		"name": "HONDA",
		"value": "HOND"
	  },
	  "vehicleColor": {
		"name": "White",
		"value": "WHI"
	  },
	  "vehicleModel": {
		"name": "CR-V",
		"value": "CRV"
	  }
	},
	{
	  "unitNumber": 2,
	  "vehicleMake": {
		"name": "HONDA",
		"value": "HOND"
	  },
	  "vehicleColor": {
		"name": "Blue/Light",
		"value": "LBL"
	  },
	  "vehicleModel": {
		"name": "RIDGELINE",
		"value": "RGL"
	  },
	}
  ], 
...

To me that looks like it's nested, BUT when I look at the mapping, the "nested" type isn't there. It looks like this (Only including the mapping for number and color, the rest are very similar, all key/value pairs):

{
  "mappings": {
    "properties": {
      "vehicles": {
        "properties": {
          "vehicleNumber": {
            "type": "long"
          },
          "vehicleColor": {
            "properties": {
              "name": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              },
              "value": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          },
		}
    }
  }
}

So in this case, should I just add a type before the vehicles properties? If so, am I going to need to re-index everything to accommodate that, or can it just understand that change with the current data?

4

I made the modification to the mapping such that vehicles is of type "nested" and the data seems to be there properly, but I don't see any of the fields within that nested array in the kibana visualization options. Is there a special way to access the children in that nested data structure?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.