Can't make text field aggregatable

Elastic Stack Kibana
1

Hello guys,
I'm currently facing with issue related to visualization and need help.

ELK gets syslogs from cisco routers via filebeat, it parses the logs fine, which is great and It also works great in discovery. However, the main field which is called "MESSAGE" is not aggregatable, unfortunately. The field is in text format to make it aggregatable it needs to be changed to keyword but I'm not sure. I've tried to change the type of the field but it is not possible in index pattern, I've changed the type in Legacy index templates, but nothing changed.

All I need is to add message table into dashboard.
Thank you in advance

2

Greetings from the person whose words may not be true,

Your change on legacy index template will only apply if new indices created.
Reindex will work too

POST _reindex
{
"source": {
"index": "my-index-000001"
},
"dest": {
"index": "my-new-index-000001"
}
}

3

It is true that you cannot aggregate on the text field type. You should be able to add keyword type to your existing field (documentation). After reindexing, this new field will show up as aggregatable.

4

Greetings and Happy New Year!

I just removed the old indice and created new one. Now it works fine! Thank you!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.