Creating searchable and aggregatable mappings for a new index

Elastic Stack Elasticsearch
1

I am trying to create a new index and also specify the mappings before sending any data to ES. Taking a simple example:

{
"mappings": {
"monitor": {
"properties": {
"MAX": {
"type": "float",
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"GUID": {
"type": "text",
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"STAMP": {
"format": "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type": "date"
}
}
}
}
}

I would like for both the MAX and the GUID field to be searchable and aggregatable. The goal is to be able to create a graph using the MAX field (a float type) and then filter based on the GUID (a text type which represents a server). I PUT the above json in a call to the ES cluster:

PUT my_ES:9200/theindex

I have tried various combinations and am unable for Kibana to recognise these fields as searchable or aggregatable. If i post a sample document to an index which doesn't exist yet, the new index contains searchable and aggregatable text fields (dynamic mapping) eg)

PUT my_ES:9200/theindex
{
"GUID": "0c26d3d9-c81b-4323-a4a4-cc3a884f55a2",
"MAX": "10",
"STAMP": "2016/12/05 14:47:45"
}

results in 2 GUID fields: GUID and GUID.keyword (the latter is searchable and aggregatable). I don't want the type to be TEXT for the equivalent MAX fields though.

Any help appreciated

2

Resolution: for text fields needed to be "keyword" type and, importantly, you need to have some data in the index before fields are registered as aggregatable and searchable.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.