Hi Team,
I am getting field name as filed value.For example if i select field as "AppName" getting the same in field values.So displays incorrect visualization.
Can you please help me...
Hi Team,
I am getting field name as filed value.For example if i select field as "AppName" getting the same in field values.So displays incorrect visualization.
Can you please help me...
Could you post a screenshot of your configuration and resulting visualization from Visualize?
It's because of the analysis that Elasticsearch does.
You probably want to create your own mapping so that ES doesn't analyse that field.
Read this https://www.elastic.co/guide/en/elasticsearch/guide/current/analysis-intro.html and the following chapter and it should be clearer
Then we need to set every field as not analyzed field.
Can we set field as not analyzed in kibana?
No, this is something that needs to be addressed at data ingest / index time.
the easiest way to make the fields as not analyzed is by changing the index name.
Create a new index and make sure it should start with logstash-.
With this you will see the .raw fields populating in the kibi/kibana reports. These fields are not analyzed. Hope this helps.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.