Kibana 5.0 shows field type as string, not keyword: working as designed?

Elastic Stack Kibana
1

In Elastic 5.0, I understand that the index property no longer supports the value not_analyzed.

So I'm now using the following index template to map "incoming" strings to the new-for-5.0 keyword type:

{
  "template": "fuw-*",
  "mappings": {
    "_default_": {
      "dynamic_templates": [{
        "string_fields": {
          "match": "*",
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword"
          }
        }
      }]
    }
  }
}

(Yes, I'm currently mapping all incoming string fields to the keyword type. Later, I might selectively map some fields to keyword and others to text.)

This seems to be working: for example, after loading data into that index pattern, Kibana doesn't show separate "keyword" fields in that index pattern, and I can successfully search on the "original" (unanalyzed) values.

But I'm left with a lingering doubt: in Kibana / Management / Indices / Index Patterns, the type column still shows fields in that index pattern as string. Although, reassuringly, the analyzed column is empty/clear.

At first, I expected to see these fields as type keyword.

But then, after more research, I'm wondering whether this is working as designed.

From the description at the top of that Kibana page:

This page lists every field in the fuw-* index and the field's associated core type as recorded by Elasticsearch.

From the Elastic documentation topic "Field datatypes":

Core datatypes

string
text and keyword

Based on that documentation, perhaps Kibana is correctly reporting string as the core type, where text and keyword are types that "belong" to that core type?

What's the situation here? Working as designed; should display keyword; or work-in-progress?

2

Hi @GrahamHannington,

this is working as designed. As you already deduced from the description, Kibana intentionally maps the type to the core datatype. From a formatting perspective both text and keyword are treated the same.

3

Thanks.

With apologies if, with some justification, you feel you've just answered this: is there anywhere in Kibana that shows a field as type keyword or text, rather than string? (If Kibana's perspective is a purely formatting perspective, then I guess the answer is "No; no need to".)

Otherwise, if I want to see, with my own doubting eyes :wink:, the type keyword next to an ingested field name, is the Elasticsearch API my best option? For example...

Request

curl -XGET 'localhost:9200/fuw-*/_mapping/field/userid/?pretty'

Response

{
  "fuw-cics-test" : {
    "mappings" : {
      "cics" : {
        "userid" : {
          "full_name" : "userid",
          "mapping" : {
            "userid" : {
              "type" : "keyword"
...

Ah, there it is: keyword. I feel better now. :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.