Good Morning. I can not create views on graphs using the [ message] . Me returns that field is analyzed , and therefore can not use this idea , unlike the [ host ] I have the anfitrião.raw and can use them in the chart normally.
Someone can tell me where I am going wrong ?
Thank you.
Where is the data coming from? If you've got .raw fields that you haven't added yourself, I'm guessing Logstash. In that case, any string field should have an associated .raw version that is not analyzed. If that's not the case for your message field, you will have to add a rule to create one and re-index your data.
Logstash adds the .raw copy using the dynamic templates, and you could do the same if you aren't using Logstash.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.