Getting Field name as field value in Pie chart visualization

(Ashok Gandla) #1

Hi Team,
I am getting field name as filed value.For example if i select field as "AppName" getting the same in field values.So displays incorrect visualization.

Can you please help me...

(Tanya Bragin) #2

Could you post a screenshot of your configuration and resulting visualization from Visualize?

(Ashok Gandla) #3

Here is my configuration and visualization

(Mark Walkom) #4

It's because of the analysis that Elasticsearch does.
You probably want to create your own mapping so that ES doesn't analyse that field.

Read this and the following chapter and it should be clearer :slight_smile:

(Ashok Gandla) #5

Then we need to set every field as not analyzed field.

Can we set field as not analyzed in kibana?

(Tanya Bragin) #6

No, this is something that needs to be addressed at data ingest / index time.

(Navtej) #7

the easiest way to make the fields as not analyzed is by changing the index name.
Create a new index and make sure it should start with logstash-.
With this you will see the .raw fields populating in the kibi/kibana reports. These fields are not analyzed. Hope this helps.

(system) #8