How to aggregate on a text field?

Elastic Stack Kibana
1

Have spent quite a long time with this problem and would like to replicate the functionality removed (I think?) when the string type was deprecated and replaced by the text and keyword types. Mentioned in this StackOverflow post (https://stackoverflow.com/questions/31143136/indexing-a-comma-separated-value-field-in-elastic-search).

I have data relating to origin and destination country formatted as follows:

Unique ID: 1
Origin: USA,GBR,FRA
Target: CHN,RUS

Unique ID: 2
Origin: SYR
Target: FRA,GBR,RUS,CHN

The aim is to be able to aggregate the separate countries within these fields i.e. visualise the Unique Count of Unique ID with FRA within the Origin Column.

It would appear that this was the behaviour of the 'string' type prior to the introduction of the 'text' and 'keyword' types, but alas no longer.

I have attempted custom tokenizers and analyzers to no avail as well as formatting the input data with a separate row (linked via an ID) for each permutation of the different columns. However, this solution is not satisfactory as it makes the data effectively unreadable within a saved search on a dashboard.

Any help would be much appreciated :slight_smile:

2

Indexing that data into an array type should give you what you want. I'm not sure if you can do this with a custom tokenizer, or if you'd have to modify how you index data to cause it to use an array. This would make the values readable in the dashboard while still allowing you to search for a given value in an array on a specific field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.