Can I make string field as aggregatable?

Elastic Stack Kibana
1

Hi,

I want to make string field as aggregatable.

20 AM
Screen Shot 2017-09-26 at 9.05.20 AM.png1034×698 55.3 KB

I have visualization json as follows:

{
"_id": "Top-Switches-by-Endpoint-Count",
"_type": "visualization",
"_source": {
"description": "",
"uiStateJSON": "{}",
"title": "Top Switches by Endpoint Count",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{ "index": "epl_cache_today", "query": { "query_string": { "query": "*", "analyze_wildcard": true } }, "filter": }"
},
"visState": "{ "title": "Current View: Top ToRs for Fabric", "type": "pie", "params": { "shareYAxis": true, "addTooltip": true, "addLegend": true, "isDonut": true }, "aggs": [ { "id": "1", "type": "count", "schema": "metric", "params": {} }, { "id": "2", "type": "terms", "schema": "segment", "params": { "field": "Switch_Name", "size": 5, "order": "desc", "orderBy": "1" } } ], "listeners": {}}"
}
}

But when I import this json as visualization in kibana 5.5.3 I see an error:

Saved "field" parameter is now invalid. Please select a new field.
Visualize: "field" is a required parameter

I have mapping as following example

{
"name": "Switch_Name",
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
},
"count": 0,
"scripted": false,
"indexed": true,
"analyzed": false,
"doc_values": true
}

and visualization schema as follows:

"visualization" : {
"properties" : {
"description" : {
"type" : "text"
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text"
}
}
},
"savedSearchId" : {
"type" : "text"
},
"title" : {
"type" : "text"
},
"uiStateJSON" : {
"type" : "text"
},
"version" : {
"type" : "integer"
},
"visState" : {
"type" : "text"
}
}
}

When I select split slices, in aggregation when I select terms I do not see any string fields in it

Can anyone please help me with this?

Thanks,
Chirag

2

You will need to update the field mapping in ES to keyword.

It will not take effect on existing data and you might have to re-index the data.

New data flowing in will be able indexed as per the new field mapping.

PUT /my_index_name/_mapping/my_type_name
{
"my_type_name": {
"properties": {
"tag": {
"type": "keyword"
}
}
}
}

3

@vijay.sangha

I did following but getting error:

PUT epl_cache_today/_mapping/endpoint
{
"endpoint": {
"properties": {
"Br_Domain": {
"type": "keyword"
}
}
}
}

Result:
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "mapper [Br_Domain] of different type, current_type [text], merged_type [keyword]"
}
],
"type": "illegal_argument_exception",
"reason": "mapper [Br_Domain] of different type, current_type [text], merged_type [keyword]"
},
"status": 400
}

4

OK finally i see in the doc that it's not possible to change data type of a field :

Updating existing mappings

Other than where documented, existing type and field mappings cannot be updated. Changing the mapping would mean invalidating already indexed documents. Instead, you should create a new index with the correct mappings and reindex your data into that index.
So the only solution is to :

Recreate a new index with good data types
Reindex the data with the Reindex API

5

It is not working

I rebuilt the complete schema as follows

{
    "name": "VRF",
    "type": "keyword",
    "count": 0,
    "scripted": false,
    "indexed": true,
    "analyzed": false,
    "doc_values": true
},

still it shows following:
{
"epl_cache_today": {
"mappings": {
"endpoint": {
"properties": {
"VRF": {
"type": "text"
}
}
}
}
}
}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.