Field has been missed in aggregate

Elastic Stack Kibana
1

Hi all,
I am trying to build a data table visualize so that show sum of my field named as "amount". for this purpose, i am trying to use sum aggregation in the metric part but i cannot find my field in the "field" part. it is noted that there are two "amount" fields as "amount" and "amount.keyword" that type of them are string. amount.keyword field is as following which it seems is aggregatable:

image
image1274×36 1.1 KB

amount field is as following which it seems it is not aggregatable:

image
image1277×27 818 Bytes

I cannot see neither "amount" nor "amount.keyword" in aggregation of visualize. how can i handle this issue? any advise will be so appreciated. Regards

2

having a .keyword variant of a field is the default behavior of Elasticsearch: Elasticsearch replaces string type with two new types text and keyword. | Elastic Blog

They refer to the same data, they are just indexed in a different way. When you want to aggregate, amount.keyword is the right field to use - you can overwrite the shown name in the visualization.

I cannot see neither "amount" nor "amount.keyword" in aggregation of visualize

What aggregation are you trying to use? A keyword field can be used with "Unique count", "Terms" and "Significant terms"

3

many thanks for your reply. i want to use sum aggregation. how can i use amount.keyword for sum?

4

If amount is actually a number, then the mapping of your index in Elasticsearch is wrong - recreate your index with the right mapping (specifying amount is a number): https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#create-mapping , then reindex your existing data https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html

After that, recreate your index pattern in Kibana and the field will be recognized as number

5

Many thanks. yes amount is number. does type of previous saved documents and also new ones of this field change?

6

You need to update existing documents by reindexing them into a new index with the correct mapping for the amount field. Check out the links I provided in my previous answer.

7

many thanks for your reply. updating mapping faced with following message:

PUT /my_index/_mapping/reqres
{
    "properties": {
      


              "amount" : {
            
          "type": "long" 
    
    
            }
            }
      }

error message:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "mapper [amount] of different type, current_type [text], merged_type [long]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "mapper [amount] of different type, current_type [text], merged_type [long]"
  },
  "status": 400
}
8

You need to create a new index for this, then use the re-index api to move data over.

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.