Keyword field on bucket aggregation

I have explained a short version of a much bigger problem.

I have two indices, sam & sam-2.
There is a user field in both indices, sam with mapping type as keyword only...
sam-2 with multiple fields mapping type, text and keyword.

Now, i try to visualize the data with a common index pattern sam* for both indices in DataTable.

For selecting user.keyword as term in bucket-aggregation, I get value of user.keyword displayed for the sam-2,whereas nil for sam.
Both have same number of documents.

Screenshot:

I don't understand, why i get nil for keyword mapping type.
Isn't keyword datatype used for aggregations.

Found the solution.
Since the sam-2 doesnot have any field called 'keyword', it will surely show nil.

So, now if i need to aggregate on the user field, i need to use the user not user.keyword on sam-2 and user.keyword in sam.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.