HI guys,
I am new to ELK stack. I am trying to understand how keyword type work with different setting. To test, I set following fields:
"OS": { "type": "text","fields":{
"keyword":{
"type":"keyword",
"ignore_above":256
}
}},
"OS2": { "type": "keyword",index: false },
"OS3": { "type": "keyword",index: false,"ignore_above":256 },
"OS4": { "type": "keyword",index: true,"ignore_above":256 },
"tt": { "type": "keyword",index: true},
From management console in Kabana, I can see all fields above are aggregatable.
But only OS.keyword can return results as expected. The other fields always return zero results.
GET /logs3/visit3/_search?pretty
{
"aggs":{
"os2":{
"terms":{
"field": "OS2"
}
}
}
}
Can you help me to point what is correct way to set a non-indexed type but aggregatable field?
Possible values in fields are: Mac OS, IOS, Android....