Kibana and Elasticsearch not having same mapping

Elastic Stack Kibana
#1

Hi,

I am currently using python to insert data into elasticsearch , before inserting it into elasticsearch and the same mapping is displayed when i run the curl request.

curl localhost:9200/index1/table1/_mapping
{"index":{"mappings":{"table1":{"properties":{"id":{"type":"long"},"bucket":{"type":"string","index":"not_analyzed"},"countries":{"type":"string"},"name_id":{"type":"string"},"name":{"type":"string","index":"not_analyzed"},"

I pasted part of mapping but what i wanted to point out is that my "name" field is not_analyzed. Thus when i use aggs it gives me distinct results when i am running the curl requests from terminal or via python.

But the same field "name" in my kibana setting is showcased as analyzed and grouping some variables which is incorrect in my case. I have deleted and reloaded the index but it's not working.

#2

Is there a template that could be causing this?

#3

Hi Mark,

Thanks again for the reply. :smile:

How can i check where the template is stored?

-Aditya

#4

localhost:9200/_template will return all the templates.

#5

Hi Mark,

Thanks !

I got the following output:
{
  "logstash" : {
    "order" : 0,
    "template" : "logstash-*",
    "settings" : {
      "index.refresh_interval" : "5s"
    },
    "mappings" : {
      "_default_" : {
        "dynamic_templates" : [ {
          "message_field" : {
            "mapping" : {
              "index" : "analyzed",
              "omit_norms" : true,
              "type" : "string"
            },
            "match_mapping_type" : "string",
            "match" : "message"
          }
        }, {
          "string_fields" : {
            "mapping" : {
              "index" : "analyzed",
              "omit_norms" : true,
              "type" : "string",
              "fields" : {
                "raw" : {
                  "ignore_above" : 256,
                  "index" : "not_analyzed",
                  "type" : "string"
                }
              }
            },
            "match_mapping_type" : "string",
            "match" : "*"
          }
        } ],
        "_all" : {
          "omit_norms" : true,
          "enabled" : true
        },
        "properties" : {
          "geoip" : {
            "dynamic" : true,
            "type" : "object",
            "properties" : {
              "location" : {
                "type" : "geo_point"
              }
            }
          },
          "@version" : {
            "index" : "not_analyzed",
            "type" : "string"
          }
        }
      }
    },
    "aliases" : { }
  }
}

It didn't mention indexes which were not starting with logstash

#6