Collapse similar words in one

Elastic Stack Kibana
1

Hi,
Sorry, I'm new here and maybe my question is not related directly to Kibana.
I have a Cloud Tag visualisation with most popular keywords. Problem in that there are many similar words like "webmail" and webmail or Webmail or WebMail. I would like to collapse all these similar words to one keyword, webmail, for example.
Could you please give me right direction? How this can be done?
Thanks.

2

This has to do with how your data is analyzed as it is indexed into Elasticsearch. Could you provide your mapping?

3

I hope, it is correct?

curl -XGET -u elastic 'domain.com:9200/saved_queries/_mapping?pretty'
Enter host password for user 'elastic':
{
"saved_queries" : {
"mappings" : {
"query" : {
"properties" : {
"query_content" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
}

4

Are you visualizing on query_content.keyword or query_content?

5

It is query_content.keyword.
Thanks.

6

You'll have to visualize on query_content instead, which means you may have to update your mappings to enable field data on this field.

1 Like
7

Could you please clarify a little bit why do you think so? Thanks.

8

The query_content.keyword field is of type keyword, which means it isn't analyzed before it is indexed into ElasticSearch. On the other hand, the query_content field is of type text, which means it is analyzed before indexing. (See the documentation for the text type and keyword type for more information.)

By default, text types are not aggregatable, which means they won't show up in the list to select for things like the cloud tag visualization, which means you'll have to update the mapping for the query_content field to enable fielddata.

Hope this helps!

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.