Getting null in dynamic mapping field


I am using following version of Kibana:
Version: 6.1.2

I have created dynamic mapping field using PUT MAPPINGS api in following way:

PUT /logstash-2019.05.31/doc/_mapping
        "message": {
            "type": "text",
            "norms": false,
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 2048

Because I wanted to perform aggregate function of message field but it is text type. So i added message.keyword of keyword type.

But when I see the data, in many places, data is present in the message but message.keyword is empty. After some inspections, I realised that if any special character is present that message.keyword is null.

Kindly help me to resolve the issue.


Hi there! I found some other threads which look similar to the problem you're having. I think you might need to use a custom analyzer to prevent those special characters from being stripped. Note that this occurs at index-time, so you may need to create your custom analyzer, apply it to a new index, and then reindex your data to make it searchable the way you want.

Here are some related resources which you might also find helpful:

1 Like

Thank you very much. I will try with custom analyzer.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.