How to achieve not_analyzed field mapping in AWS solution

(Mark Watkins) #1

My first post was the below:


I am trying to count unique log streams, and the format of the value is "i-123abc456".
When I do the unique count, it counts the "i" as one value, so it is adding 1 to my unique count.

i.e. if I had a legend, we would have:

If there were two log streams, "i-123abc456" and "i-789def101", then the count would be three and the legend would be:

Do you know what I can do to fix this pls?

Second question: Now I need to know how to achieve not analysed fields in AWS - if possible?


(David Pilato) #2

Define this field as not_analyzed.

As soon as you can push your mapping it should be doable.

(Mark Watkins) #3

Is this all possible within the AWS managed service of ES and Kibana?

(David Pilato) #4

I have no idea but I suppose it is... Why?

Is that not working for you? What did you do to define your mapping?

(Mark Watkins) #5

Mapping is automatically generated. AWS have launched a managed version, and I think it might be missing some of the features I need to be able to define the field as not_analyzed - might be wrong, but cannot see where I can edit mappings...

(Mark Watkins) #6

I can see the option to add scripted fields... maybe there is a solution there.

(David Pilato) #7

I don't believe so. May be you have a link to AWS doc?

But let me say that mappings are automatically generated by elasticsearch on premise as well unless you specifically PUT your mapping before pushing the very first document.

Search for PUT mapping in elasticsearch doc.

(system) #8