How to graph a pie including null values

Elastic Stack Kibana
1

Hello,

I have a lot of apache logs and I would like to make a pie about terms of a field that may contain any string, and often contains "-".

According to this comment, the "-" is seen as null by Elasticsearch. When I do the pie with terms, I only have the other strings, (there is only two other values possible) and no "-", while most of the pie should be about "-" logs.

How can I do a pie that includes the "-" values?

I'm using Elasticsearch/Kibana 6.0.0.

2

image

The green slice there is a "-". I'm running the latest 7.x version, but I don't think that was a very recent change. How capable are you of upgrading to the latest 6.x?

3

It's a production cluster on a "old fashioned infrastructure" which mean that the upgrade will take time and has to be planed.

However I'm interested to know the settings of your tokenizer. I use:

"settings": {
"analysis": {
"analyzer": {
"keylower": {
"filter": "lowercase",
"tokenizer": "keyword"
}
}
},

4

I didn't set up a tokenizer, in my case. Just used whatever the default is.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.