I can not use fields in graphics display


(Samuel Costa) #1

Good Morning. I can not create views on graphs using the [ message] . Me returns that field is analyzed , and therefore can not use this idea , unlike the [ host ] I have the anfitrião.raw and can use them in the chart normally.

Someone can tell me where I am going wrong ?

Thank you.


(Joe Fleming) #2

Where is the data coming from? If you've got .raw fields that you haven't added yourself, I'm guessing Logstash. In that case, any string field should have an associated .raw version that is not analyzed. If that's not the case for your message field, you will have to add a rule to create one and re-index your data.

Logstash adds the .raw copy using the dynamic templates, and you could do the same if you aren't using Logstash.


(system) #3