Kibana-4.6.4 have an issues with datatables where fields is containing string values

[yash_mangla (Yash M.)]

Hi Guys,

I have an issue with kibana-4.6.4 datatables. can you help how can i modify the setting as latest kibana have
In development server we are using

elasticsearch-2.x version
kibana-4.x version

In visualization datatables it's showing like

In above screen is showing only one random word per row instead of sentence.

On Other Side with same data and same fields in latest kibana showing pretty good.

it's showing complete sentences per row as i expected instead of random words per row.

I want to visualize complete sentence per row in kibana-4.6.4 instead of words. I can't use latest distribution of elk stack due to some latest os version dependency issues on development server.

I just want this functionality in kibana-4.6.4 version how can i acheive this. please suggest me right way to do it ?

[Christian_Dahlqvist]

In Kibana 4.6.4 it looks like you are aggregating over an analysed field, which is why you see individual tokens in the table. If you are using standard Logstash mappings, there should be a non-analysed version of the field available as errMsg.raw. If you use this you should see the same behaviour as in Kibana 5.x.

[yash_mangla (Yash M.)]

Hi @Christian_Dahlqvist,

But i'm using logstash to parse the logs. i wrote a script which parse the existing logs and pushed into elasticsearch. then i connect to kibana.

i found this configuration regarding errMsg.raw mapping https://github.com/elastic/logstash/blob/v1.3.1/lib/logstash/outputs/elasticsearch/elasticsearch-template.json

but i don't know how can i use this configuration and where to use it which helps i can create errMsg.raw fields.

give me some hint or sample example in right direction.

[Christian_Dahlqvist]

The best way would be to create an index template, which defines the mappings when the index is first created. The template you linked to is an example, though from a very old version of Logstash. This may be a better starting point.