Hello,
We are using Elasticsearch v5.3, the issue we are seeing is that the aggregates on a term are not working on a custom defined analyzer (keyword tokenizer).
We have created a custom analyzer:
{
"settings": {
"analysis" : {
"analyzer" : {
"custom_keyword_analyzer": {
"tokenizer": "keyword"
}
}
}
}
}
Which we are applying to a field like so:
"properties": {
"portfolio": {
"type": "text",
"analyzer": "custom_keyword_analyzer"
}
}
The issue we are running into is that when searching using that tokenizer it does not return any aggregated data, the buckets in the aggregate response are empty. Here is an example search query with an aggregate using this tokenized field:
"aggs": {
"days_total_price": {
"sum": {
"field":"cost"
}
},
"grouped_by_portfolio":{
"terms": {
"field":"portfolio"
}
}
}
However, if we create our mapping like so (instead of using the custom analyzer):
"properties": {
"portfolio": {
"type": "text",
"fields": {
"raw": {
"type": "keyword"
}
}
}
}
We are able to do a search using .raw:
"aggs": {
"days_total_price": {
"sum": {
"field":"cost"
}
},
"grouped_by_portfolio":{
"terms": {
"field":"portfolio.raw"
}
}
}
This search returns the aggregates in the 'buckets' as expected.
Based on the documentation and research (Help understanding keyword vs not_analyzed, https://www.elastic.co/guide/en/elasticsearch/reference/5.3/analysis-keyword-tokenizer.html) these two mappings should behave the same. What have we done wrong? Thank you!