ElasticSearch Kibana Fields with "keyword"

Hi, I had some questions about Kibana Data Analysis training, mainly in fields with "keyword".

  1. Why the search (occupation: "Sales") got a result of "Sales Engineer"? I thought it should be exact match for this search?

Alternatively, if I use (occupation.keyword: "Sales"), there won't be this issue. Why such difference?

  1. When I use (occupation : "marketing") I can get 314 hits but if changed to (occupation.keyword : "marketing") there's 0 hit. When shall I use "occupation"? And when to use "occupation.keyword"?

occupation is a text field, occupation.keyword is a keyword field. Both are using the same underlying data, but they index it in different ways.

Text fields index individual words and allow full text search (how exactly this works can be configured - Text field type | Elasticsearch Reference [7.12] | Elastic ). That's why occupation: "Sales" shows the "Sales Engineer" result. By default they are also case-insensitive.

Keyword fields on the other hand are simpler - they just match the perfect phrase ( Keyword type family | Elasticsearch Reference [7.12] | Elastic ). It also allows to do aggregations (e.g. "give me the top 5 occupations and their respective counts" - you can do this with visualizations), something that's not possible with text fields.

Which one to use depends on your use case - an id field for example doesn't make sense to index as a text field as you never want partial matches and case sensitivity matters. A tweet field very likely should be a text field, because you rarely want to match the perfect text, but search for parts of the whole message.

As Elasticsearch can't tell what you are planning to do, by default strings are indexed twice - as keyword and as text. You can (and should) configure this in the mapping though once you know what you want to do.

In short:

  • text field type: Full text search
  • keyword field type: Perfect matches (ids, iso country codes, ...) and aggregations
1 Like

Very clear. Thank you very much. :grinning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.