Collapse similar words in one

[pavuk (Igor Gubaidullin)]

Hi,
Sorry, I'm new here and maybe my question is not related directly to Kibana.
I have a Cloud Tag visualisation with most popular keywords. Problem in that there are many similar words like "webmail" and webmail or Webmail or WebMail. I would like to collapse all these similar words to one keyword, webmail, for example.
Could you please give me right direction? How this can be done?
Thanks.

[lukas (Lukas Olson)]

This has to do with how your data is analyzed as it is indexed into Elasticsearch. Could you provide your mapping?

[pavuk (Igor Gubaidullin)]

I hope, it is correct?

curl -XGET -u elastic 'domain.com:9200/saved_queries/_mapping?pretty'
Enter host password for user 'elastic':
{
"saved_queries" : {
"mappings" : {
"query" : {
"properties" : {
"query_content" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
}

[lukas (Lukas Olson)]

Are you visualizing on query_content.keyword or query_content?

[pavuk (Igor Gubaidullin)]

It is query_content.keyword.
Thanks.

[lukas (Lukas Olson)]

You'll have to visualize on query_content instead, which means you may have to update your mappings to enable field data on this field.

[pavuk (Igor Gubaidullin)]

Could you please clarify a little bit why do you think so? Thanks.

[lukas (Lukas Olson)]

The query_content.keyword field is of type keyword, which means it isn't analyzed before it is indexed into ElasticSearch. On the other hand, the query_content field is of type text, which means it is analyzed before indexing. (See the documentation for the text type and keyword type for more information.)

By default, text types are not aggregatable, which means they won't show up in the list to select for things like the cloud tag visualization, which means you'll have to update the mapping for the query_content field to enable fielddata.

Hope this helps!