I am running the latest versions of Kibana, Logstash and Elasticsearch. I am unsure how to make my logMessage field aggregatable. I have searched on the forums for a solid answer but can't seem to find a definitive one. Here is my mappings. [image] "mappings": { "prnformat": { "properties":{…

You should be able to add a field to the existing mapping: documentation PUT prn-/_mapping/prnformat { "properties": { "logMessage": { "type": "text", "fields": { "raw": { "type": "keyword" } } } } } Then you should be able to aggregate on…

More than likely, the field you are trying to aggregate on is not populated with data in your index. Here is a link to another thread that asked a similar question.

[image] I have data in that index.

Is there data in that field in your index? If so, are you using a wildcard in your index pattern? This can also occur when there is a type inconsistency for a field between two indexes in the same index pattern. You could start by creating a new index pattern in kibana that only examines a single …

I did have a wildcard in the index pattern. But when I created an index without the wildcard there was data present and the field was still unaggregatable

Can you execute this in the Dev Tools console and report the results? GET <whatever your index is>/_mapping/<whatever your type is>/field/logMessage

Yeah, sorry I missed that earlier. You can't aggregate on a text field type. You need a keyword field type to aggregate. https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html#text

I changed it in my json template and rebooted the system and it still comes up as a text type. [image] [image]

I am sorry for all of these questions. I am not terribly good with Kibana and the json templates. I prefer logstash. I made my json template this: [image] And the new logMessage.raw never showed up when I created a new index. I put that message in the console and this is what the output came out t…

The message returns seems to indicate that you're attempting to change the analyzer. With mappings, you can only add things. Most things can't be changed. These are the steps that I went through to try and figure out the issue: # Delete any existing test index DELETE test_index # Create a new ind…

How to make a field aggregatable in Kibana

Elastic Stack Kibana

CDR (Colton) June 22, 2017, 7:27pm 11

I am sorry for all of these questions. I am not terribly good with Kibana and the json templates. I prefer logstash. I made my json template this:

And the new logMessage.raw never showed up when I created a new index. I put that message in the console and this is what the output came out to be:

Topic		Replies	Views
Can't make text field aggregatable Kibana	4	1412	January 31, 2022
How to make a field aggregable in Kibana Kibana	5	468	July 14, 2018
Unable to make a field aggregatable in kibana Elasticsearch	27	10496	January 25, 2019
Unable to make a field aggregatable in kibana/ES Kibana	3	1508	February 8, 2019
How to make a text field aggregate-able in Kibana Kibana	5	878	September 6, 2023

How to make a field aggregatable in Kibana

Related topics