Elastic Stack Lab 5

One of the initial tasks is to create a Pie Chart on the response field. But the response field cannot be aggregated. So normally I'd use the response.raw field, but it seems response.keyword replaced that. But I'm getting a value of zero for all the keyword fields. The course was written for a previous version, there are significant differences with the current version, but most everything else has worked eventually. Where did I get off track here?

Never mind I figured it out. Another gotcha from a class written on an old version. When creating the lab data, there is a conversion script that changes the dates to relatively current dates. However, if you don't complete the class in one day, which is quite a chore actually, it will generate a new index the next day. Problem is all the old converted data are numbers and the new field is text. So there is a conflict. Removing the indexes was the easiest since I'm not going to add any data. The missing .raw field still bothers me however.

Hey William,
sorry to hear that the labs are old :confused: but I am glad you figured it out. Let us know if you have any other question and we will try to help. (It is always good to add the full name of the course and the current version that you are using.)


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.