Convert text field to keyword using runtime field

[sunilmpatil (Sunil)]

Hi,

I have log data ingested into multiple elasticsearch indices. Index pattern is created to generate Kibana dashboard. Some fields are created as text, hence I am not able to use them in Kibana aggregations. I tried using runtime fields, but it's not working. Reindexing is costly affair, as there are multiple indices.
I tried multi fields, but I am unable to update the mapping for nested fields with text datatype.
Please suggest if there are any alternatives.
Thanks in advance.

[stephenb (Stephen Brown)]

Hi @sunilmpatil

If you looks at the docs here you will see you can do exactly what you are looking for using the Scriptless form or _source

@sunilmpatil

I tried using runtime fields, but it's not working.

How is it not working... if you want to use runtime fields in aggregations you must add them to the mapping not just the index pattern / data view..

Run these and look at the results

DELETE discuss-test-runtime
PUT discuss-test-runtime/
{
  "mappings": {
    "properties": {
      "some_text": {"type": "text"}
    }
  }
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color blue"
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color blue"
}

POST discuss-test-runtime/_doc  
{
  "some_text" : "the color green"
}



PUT discuss-test-runtime/_mapping
{
  "runtime": {
    "some_keyword": {
      "type": "keyword",
      "script": {
        "source": "emit(params._source.some_text)",
        "lang": "painless"
      }
    },
    "some_text": {
      "type": "keyword"
    }
  }
}

GET discuss-test-runtime/_search
{
  "fields": [
    "*"
  ]
}

GET discuss-test-runtime/_search
{
  "size": 0, 
  "aggs": {
    "myagg": {
      "terms": {
        "field": "some_text",
        "size": 10
      }
    }
  }
}

GET discuss-test-runtime/_search
{
  "size": 0, 
  "aggs": {
    "myagg": {
      "terms": {
        "field": "some_keyword",
        "size": 10
      }
    }
  }
}


# Results of last 2 Aggs

# GET discuss-test-runtime/_search 200 OK
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "myagg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "the color blue",
          "doc_count": 2
        },
        {
          "key": "the color green",
          "doc_count": 1
        }
      ]
    }
  }
}
# GET discuss-test-runtime/_search 200 OK
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "myagg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "the color blue",
          "doc_count": 2
        },
        {
          "key": "the color green",
          "doc_count": 1
        }
      ]
    }
  }
}