Getting Field name as field value in Pie chart visualization


(Ashok Gandla) #1

Hi Team,
I am getting field name as filed value.For example if i select field as "AppName" getting the same in field values.So displays incorrect visualization.

Can you please help me...


(Tanya Bragin) #2

Could you post a screenshot of your configuration and resulting visualization from Visualize?


(Ashok Gandla) #3

Here is my configuration and visualization


(Mark Walkom) #4

It's because of the analysis that Elasticsearch does.
You probably want to create your own mapping so that ES doesn't analyse that field.

Read this https://www.elastic.co/guide/en/elasticsearch/guide/current/analysis-intro.html and the following chapter and it should be clearer :slight_smile:


(Ashok Gandla) #5

Then we need to set every field as not analyzed field.

Can we set field as not analyzed in kibana?


(Tanya Bragin) #6

No, this is something that needs to be addressed at data ingest / index time.


(Navtej) #7

the easiest way to make the fields as not analyzed is by changing the index name.
Create a new index and make sure it should start with logstash-.
With this you will see the .raw fields populating in the kibi/kibana reports. These fields are not analyzed. Hope this helps.


(system) #8