I am trying to create a new index and also specify the mappings before sending any data to ES. Taking a simple example:
{
"mappings": {
"monitor": {
"properties": {
"MAX": {
"type": "float",
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"GUID": {
"type": "text",
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"STAMP": {
"format": "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type": "date"
}
}
}
}
}
I would like for both the MAX and the GUID field to be searchable and aggregatable. The goal is to be able to create a graph using the MAX field (a float type) and then filter based on the GUID (a text type which represents a server). I PUT the above json in a call to the ES cluster:
PUT my_ES:9200/theindex
I have tried various combinations and am unable for Kibana to recognise these fields as searchable or aggregatable. If i post a sample document to an index which doesn't exist yet, the new index contains searchable and aggregatable text fields (dynamic mapping) eg)
PUT my_ES:9200/theindex
{
"GUID": "0c26d3d9-c81b-4323-a4a4-cc3a884f55a2",
"MAX": "10",
"STAMP": "2016/12/05 14:47:45"
}
results in 2 GUID fields: GUID and GUID.keyword (the latter is searchable and aggregatable). I don't want the type to be TEXT for the equivalent MAX fields though.
Any help appreciated