I am running the latest versions of Kibana, Logstash and Elasticsearch. I am unsure how to make my logMessage field aggregatable. I have searched on the forums for a solid answer but can't seem to find a definitive one. Here is my mappings. [image] "mappings": { "prnformat": { "properties":{…

You should be able to add a field to the existing mapping: documentation PUT prn-/_mapping/prnformat { "properties": { "logMessage": { "type": "text", "fields": { "raw": { "type": "keyword" } } } } } Then you should be able to aggregate on…

Discuss the Elastic Stack

How to make a field aggregatable in Kibana

Elastic Stack Kibana

CDR (Colton) June 22, 2017, 5:11pm 7

Use of text fields in Visualizations

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.