Can I make string field as aggregatable?

Hi,

I want to make string field as aggregatable.

I have visualization json as follows:

{
"_id": "Top-Switches-by-Endpoint-Count",
"_type": "visualization",
"_source": {
"description": "",
"uiStateJSON": "{}",
"title": "Top Switches by Endpoint Count",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{ "index": "epl_cache_today", "query": { "query_string": { "query": "*", "analyze_wildcard": true } }, "filter": }"
},
"visState": "{ "title": "Current View: Top ToRs for Fabric", "type": "pie", "params": { "shareYAxis": true, "addTooltip": true, "addLegend": true, "isDonut": true }, "aggs": [ { "id": "1", "type": "count", "schema": "metric", "params": {} }, { "id": "2", "type": "terms", "schema": "segment", "params": { "field": "Switch_Name", "size": 5, "order": "desc", "orderBy": "1" } } ], "listeners": {}}"
}
}

But when I import this json as visualization in kibana 5.5.3 I see an error:

Saved "field" parameter is now invalid. Please select a new field.
Visualize: "field" is a required parameter

I have mapping as following example

{
"name": "Switch_Name",
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
},
"count": 0,
"scripted": false,
"indexed": true,
"analyzed": false,
"doc_values": true
}

and visualization schema as follows:

"visualization" : {
"properties" : {
"description" : {
"type" : "text"
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text"
}
}
},
"savedSearchId" : {
"type" : "text"
},
"title" : {
"type" : "text"
},
"uiStateJSON" : {
"type" : "text"
},
"version" : {
"type" : "integer"
},
"visState" : {
"type" : "text"
}
}
}

When I select split slices, in aggregation when I select terms I do not see any string fields in it

Can anyone please help me with this?

Thanks,
Chirag

You will need to update the field mapping in ES to keyword.

It will not take effect on existing data and you might have to re-index the data.

New data flowing in will be able indexed as per the new field mapping.

PUT /my_index_name/_mapping/my_type_name
{
"my_type_name": {
"properties": {
"tag": {
"type": "keyword"
}
}
}
}

@vijay.sangha

I did following but getting error:

PUT epl_cache_today/_mapping/endpoint
{
"endpoint": {
"properties": {
"Br_Domain": {
"type": "keyword"
}
}
}
}

Result:
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "mapper [Br_Domain] of different type, current_type [text], merged_type [keyword]"
}
],
"type": "illegal_argument_exception",
"reason": "mapper [Br_Domain] of different type, current_type [text], merged_type [keyword]"
},
"status": 400
}

OK finally i see in the doc that it's not possible to change data type of a field :

Updating existing mappings

Other than where documented, existing type and field mappings cannot be updated. Changing the mapping would mean invalidating already indexed documents. Instead, you should create a new index with the correct mappings and reindex your data into that index.
So the only solution is to :

Recreate a new index with good data types
Reindex the data with the Reindex API

It is not working

I rebuilt the complete schema as follows

{
    "name": "VRF",
    "type": "keyword",
    "count": 0,
    "scripted": false,
    "indexed": true,
    "analyzed": false,
    "doc_values": true
},

still it shows following:
{
"epl_cache_today": {
"mappings": {
"endpoint": {
"properties": {
"VRF": {
"type": "text"
}
}
}
}
}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.