How to filter records containing a particular string in a field value for a kibana visualization

Hi, analyzed text mapping is for fulltext search. For example, if you had a lot of biography data, and you needed to find the biographies that have certain words, phrases, topics, etc - you would want analyzed text. You don't want analyzed text mapping for doing log analysis.

The mapping of the logs should be plain keyword, not multi-field. If the field has pageUrl.keyword and pageUrl.analyzed, then it is multi-field.

https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html#multi-fields

Trying to do wildcard search on pageUrl-as-analyzed text is not going to work, because the Elasticsearch tokenizer breaks up the string for full-text search, which is not what you want in your data.

When you filter pageUrl:http://example.com/, I'm not entirely sure if that references the keyword part by default. The multi-fields mapping will lead to other instances of confusion for Kibana, too.

1 Like