How to use "aggs" on a text type field

Elastic Stack Elasticsearch
1

Hi everyone!

I have a problem that I have been unable to solve for the past couple of months. I am using ES 6. In my index, there is a field of type "text". Documents keep increasing every day. I want to check & count all the fields with their values created on a particular day/date. My field value looks like this " abc/456/xyz/23-b/mnb.cb" . Everytime I try to use aggs on this field, Elastic search tokenizes like "abc", "456", "xyz", "23",etc and counts every tokens how many times they occur throughout an index. My main objective is to see how many duplicates are there, and I want ES to take my field value "abc/456/xyz/23-b/mnb.cb" as a single string and tell me if there is any exact looking value if any for a particular date. I have tried doing textfield=True, but it doesnot let me. Lot of people are talking about update mapping ; index=not analyzed. But, looks like you can't do it anymore. its either true or false only at the time of indexing and I don't want to reindex. What are my options here? please help!!

2

Hi zatom,

What you are looking for is the keyword data type which does not break strings into multiple tokens

3

@Mark_Harwood Hi Mark. can I update that in my mapping setting? or I can do it only at the time of indexing?

Thank you

4

It's not possible to change the type from text to keyword but you can use the reindex api to copy the docs to a new index with the correct mapping

5

@Mark_Harwood Thanx for the suggestion. What are the cost of reindexing if any? My index has more than 20million documents. Is it a good idea to reindex for that amount of volume? How long should it take?

PUT my_index
{
"mappings": {
"properties": {
"tags": {
"type": "keyword"
}
}
}
}

Will this get applied to all my fields or a particular field if I specify?

6

At least the same as the cost of original indexing - it's essentially reading and writing again all of the content. The storage will of course be doubled until you delete the old index

That might be how you declare a new field but cannot be used to change the type of an existing tags field in an index.

7

@Mark_Harwood thank you. Will let you know if any questions in future

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.