How to sort based on field in search ouput

Elastic Stack Kibana
1

Hi,

It seems that .raw fields are not displayed in search results output (both discover and dashboard) and Kibana throws an error if I try to sort based on analyzed field.

123.png1901×822 68 KB

For example I would like to sort by host, but this is not possible. If I use host.raw Kibana shows - instead of text. And if I use host field, it will throw "Field data loading is forbidden on host" error.

So what should I do? Disable analyze on fields that I want to sort? Or some other approach to sort logs?

2

So I ended up with writing my own templates for fields in ES. Works fine now.

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

1 Like