Can't see all fields when Visualize->Aggregation->Terms is selected in Kibana

[anupam]

I am using Kibana 5.2.2. I love how easy it was to setup.

I have spent some time in figuring out the issue that I am facing but without any luck yet. I have a very simple index with a few string and number values in it. I created and saved a simple search in 'Discover' and now trying to use it to create a Pie Chart visualization. In the saved search, I have some Names (a text column in the saved search) that falls in one of two categories. Categories is another text column in the saved search. Now in the pie chart, when I select 'Split Slices' and 'Aggregation->Terms', the fields dropdown only has '_type' . I was expecting the Category to also be there so that I can create the pie chart based on it.

Am I missing anything obvious?

Thanks in advance.

[tsullivan (Tim Sullivan)]

It sounds like the mapping of the Name and Category field is mapped as text which is the field type used for search analysis, not aggregations. In 2.x this would have worked, but would be very inefficient since it uses field data. In 5.x, field data is disabled in ES.

You can check this yourself by looking at the mapping in Dev Tools Console:

GET my_index/my_type/_mapping/field/Name

In order to use the field for aggregations, the type should be keyword.

See: Text type family | Elasticsearch Guide [8.11] | Elastic

...Text fields are not used for sorting and seldom used for aggregations (although the significant terms aggregation is a notable exception).

If you need to index structured content such as email addresses, hostnames, status codes, or tags, it is likely that you should rather use a keyword field.

[anupam]

Thanks Tim! That was it.

Also, I now notice the 'aggregatable' column in the index field table in Management -> Index Patterns, which lists all the fields that can be used to aggregate.

To change the field type, I had to delete the index and rebuild (perhaps the only way to change the type in 5.2.x I think)

Thanks again!