Elasticsearch splitting terms by words


(Josh) #1

I have a term that looks like this "GET /carbon/metrics-view" in discover which is correct. However when I go to visualize it is splitting it up "get" "carbon" "metrics" "view" . It is setup as not_analyzed.


(Lee Hinman) #2

Can you show the mapping from GET /indexname/_mapping? Also specify which field is causing the problem.


(Josh) #3
{

"locust-2016.09.26": {
"mappings": {
"logs": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"@version": {
"type": "string"
},
"Avg": {
"type": "long"
},
"Max": {
"type": "long"
},
"Median": {
"type": "long"
},
"Min": {
"type": "long"
},
"commands": {
"type": "string"
},
"fails": {
"type": "long"
},
"host": {
"type": "string"
},
"message": {
"type": "string"
},
"path": {
"type": "string"
},
"req\s": {
"type": "long"
},
"reqs": {
"type": "long"
},
"tags": {
"type": "string"
}
}
},
"type": {
"properties": {
"Test": {
"type": "string",
"index": "no",
"fields": {
"Raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
},
"type1": {
"_source": {
"enabled": false
},
"properties": {
"command": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}


(Josh) #4

This is okay to close I have it working now.


(Lee Hinman) #5

Okay great!


(Lee Hinman) #7

(Mark Walkom) #8

How did you fix it? Your solution may help others in future!


(system) #9