I have my device_model field, for example like this:
LENOVO IdeaTab A3000-H[graphicsDeviceName: PowerVR SGX 544MP; graphicsDeviceVendor: Imagination Technologies; graphicsDeviceVersion: OpenGL ES 2.0 build 1.9@2204701; graphicsMemorySize: 60; operatingSystem: Android OS 4.2.2 / API-17 (JDQ39/A3000_A422_003_026_130823_WW_SMS_FUSE); processorCount: 4; processorType: ARMv7 VFPv3 NEON; systemMemorySize: 974; maxTextureSize: 4096]
I want to aggregate to know devices:
"aggs" : {
"devices" : {
"terms" : { "field" : "device_model",
"size": 0
}
}
}
But it returns me only one words aggregation like this:
"aggregations": {
"user-ids": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "android",
"doc_count": 20851
},
{
"key": "api",
"doc_count": 20851
},
{
"key": "es",
"doc_count": 20851
},
But I want to see whole field. What should I do for elasticsearch not divide my string field when I aggregated?
My mapping:
"warhammer":{
"mappings": {
"logs": {
"properties": {
"cpu_avg": {"type": "double"},
"device_model": { "type": "string" }
...
I've tried to change mapping through SENSE:
PUT /warhammer
{
"device_model": { "type": "string",
"fields": { "raw":
{ "type": "string", "index": "not_analyzed" } } }
}
and it gives me:{
"error": "RemoteTransportException[[kibana.herocraft.com][inet[/192.168.0.1:9300]][indices:admin/create]]; nested: IndexAlreadyExistsException[[warhammer] already exists]; ",
"status": 400
}
what should I do next?