# Help required in visualization **URL:** \ **Category:** Kibana\ **Created:** [May 3, 2020, 6:32pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891 "2020-05-03T18:32:15Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 3, 2020, 6:32pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/1 "2020-05-03T18:32:15Z")
Hello, I do have a requirement to create visualizations of all total transactions and transactions that contain "Error" or "Exception" anywhere. The whole message is saved as {"type" : "text"} as per the mapping. Each transaction would contain different data structure so I would not be able to change to {"type : Keyword"} since I read it might cause performance issue (correct me if I'm wrong) and the other solution was to turn on field data which is also not advisable. Is there any other solution, please let me know? P.S - My transactions are XML, but stored as String right now (using store\_xml =\> false). Can this issue be solved somehow if I store transactions as XML? Cheers, Maadavan ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 3, 2020, 9:06pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/2 "2020-05-03T21:06:52Z")
Hello, Can you show an example of a document, how it looks in ES/Kibana? Type: text is the proper mapping so that shouldn't be a problem. If you search for "Exception" in discover does it show the proper documents? ---
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 3, 2020, 9:12pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/3 "2020-05-03T21:12:59Z")
@Marius_Dragomir, Thanks for swift reply. Unfortunately would not be able to share Kibana screenshot due to organisation policy. And yes, I am able to get the desired results in discover with below query. `> message : *Error* or message : *Exception*` But in Visualizations, "message" field is not available since it is not a keyword, but a text as per mappings. Would you be able to help with these limited info. please? Cheers, Maadavan ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 3, 2020, 9:16pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/4 "2020-05-03T21:16:11Z")
You should use the multi-field setup in Elasticsearch in order to have the field both as raw and as keyword. This way you can search for it in Discover and also use it in Kibana visualizations. [https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html) ---
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 3, 2020, 9:44pm UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/5 "2020-05-03T21:44:14Z")
@Marius_Dragomir, Few queries. 1. The "message" field which we are discussing here, would be big up to 5MB, so setting this multi field wouldn't cause any performance issue? 2. Since the field would contain many values, is it safe to increase from default ignore\_above to values around 100000. > "ignore\_above": 256 1. Below is the snippet of current mapping, I dont see find exactly where it has to be changed to make it as multi-field based on the reference you shared. > "message": { > "type": "text", > "fields": { > "keyword": { > "type": "keyword", > "ignore\_above": 256 > } > } > } Cheers, Maadavan ---
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 4, 2020, 5:36am UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/6 "2020-05-04T05:36:25Z")
I have changed my indexing slightly by trimming few unwanted wrappers in the message and adding it to a new field "payloadString" which is now available for aggregation , **but** not for most of my documents, since it is ignored due to below parameter. > ignore\_above : 256 So is there any other solution to make entire string available for aggregation? Cheers, Maadavan ---
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 5, 2020, 5:29am UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/7 "2020-05-05T05:29:01Z")
Team, Any suggestions or idea please? Cheers, Maadavan ---
**Author:** ![Saravana\_Maadavan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_maadavan/32/60232_2.png) [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Post date:** [May 12, 2020, 4:45am UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/8 "2020-05-12T04:45:03Z")
Kibana Team, Any suggestions please? Cheers, Maadavan ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 9, 2020, 4:45am UTC](https://discuss.elastic.co/t/help-required-in-visualization/230891/9 "2020-06-09T04:45:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.