Kibana Vega visualisation - empty aggregation buckets in JS object

[krakora (Jan Krákora)]

Dear team,

I like create a word cloud visualisation like the one in https://vega.github.io/vega/examples/word-cloud/ but I got stuck in Vega data object definition.

Using the Kibana Dev tools I can search query

GET /_search
{
  "size": 0,
  "aggs": {
    "messages": {
      "terms": {
        "field": "log_message.keyword"
      }
    }
  }
}

that returns result as follows:

{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 17,
    "successful": 17,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 65657,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "messages": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "Cannot convert null to 'System.DateTime' because it is a non-nullable value type",
          "doc_count": 33
        },
        {
          "key": "Create: Customer code is not in required ERP format!",
          "doc_count": 31
        },
        {
          "key": "IMEI: 00-0F-33-35-32-30-39-33-30-38-31-36-35-39-38-38-39",
          "doc_count": 2
        },
        {
          "key": "IMEI: confirmed",
          "doc_count": 2
        },
        {
          "key": "data confirmation: 00-00-00-01",
          "doc_count": 2
        }
      ]
    }
  }
}

Using the Vega approach:

{
  // Cloud example: https://vega.github.io/vega/examples/word-cloud/

  $schema: https://vega.github.io/schema/vega-lite/v2.json
  title: Cloud from all messages

  // Data source
  data: {
    url: {
      // ES 
      %context%: true
      %timefield%: @timestamp
      // All indexes
      index: _all
      // Aggregate data
      body: {
        aggs: {
          messages: {
            terms: {
              field: log_class.keywords
            }
          }
        }
      }
    }
  // Filter the object
  //  format: {property: "aggregations.messages.buckets"}
  
  }
  
  // "mark" 
  mark: {
    type: "text"
    // ...
  }
}

the Chrome JS console shows empty aggregation object

Do you have any hint?

Thank you in advance

BR
Jan

[Bill_McConaghy]

@krakora

field: log_class.keywords

I think that line in your vega config should be: field: log_class.keyword

[krakora (Jan Krákora)]

Thank you Bill.

Moreover, I have found other issues in my Vega code:

...
 $schema: https://vega.github.io/schema/vega/v3.json
...
data: {
  name: "table"
  url: {
...
field: log_class.keyword
...