Getting null in dynamic mapping field

Elastic Stack Kibana
1

Hi

I am using following version of Kibana:
Version: 6.1.2

I have created dynamic mapping field using PUT MAPPINGS api in following way:

PUT /logstash-2019.05.31/doc/_mapping
{
      "properties":{
        "message": {
            "type": "text",
            "norms": false,
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 2048
              }
            }
          }
      }
}

Because I wanted to perform aggregate function of message field but it is text type. So i added message.keyword of keyword type.

But when I see the data, in many places, data is present in the message but message.keyword is empty. After some inspections, I realised that if any special character is present that message.keyword is null.

Kindly help me to resolve the issue.

Thanks!

2

Hi there! I found some other threads which look similar to the problem you're having. I think you might need to use a custom analyzer to prevent those special characters from being stripped. Note that this occurs at index-time, so you may need to create your custom analyzer, apply it to a new index, and then reindex your data to make it searchable the way you want.

Here are some related resources which you might also find helpful:

1 Like
3

Thank you very much. I will try with custom analyzer.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.