Kibana4.1.1 Matrix report

Elastic Stack Kibana
1

Hello,
I am having below data in DB
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(1,'4-Low');
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(2,'4-Low');
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(3,'5-Very Low');
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(4,'1-Urgent');
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(5,'2-High');
insert into FOCUSTRPF(id,FOCUSTIER) VALUES(6,'3-Medium');

This data is getting loaded into ES using logstash-input-jdbc plugin.
Now in Kibana4.1.1 - Discover page i see correct data with 2 columns.
but when I go to Visualize page, I notice that column-2 data mentioned above is split into multiple tokens.
How to avoid that. Is it a bug?

2

How to add Exact-Value to that column-2

3

{
"terms" : {
"focustier" : ["1-Urgent","2-High","3-Medium","4-Low","5-Very Low"]
}
}

Trying Json input above,but no luck.

4

No, it's not a bug, that's the analysis part of indexing that ES does.

Trying looking for a .raw field with the same name as the other one.

5

Login into Kibana and remove focustrpf from "settings tab"
Login to Elastic Search marvel plugin
http://localhost:9200/_plugin/marvel/sense/index.html
execute below commands

DELETE focustrpf
PUT focustrpf
GET focustrpf
GET focustrpf/focustrpf/_mapping
the o/p for above is {}

PUT focustrpf/focustrpf/_mapping
{
"focustrpf" : {
"properties" : {
"focustier" : {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
},
"id" : {
"type" : "long"
},
"@version" : {
"type": "string"
}
}
}
}

Check if the mapping is updated

GET focustrpf/focustrpf/_mapping

Load data using logstash.

E:\Apps\elasticsearch\logstash-1.5.3\bin>logstash.bat -f ../config/jdbc2c-config.txt
io/console not supported; tty will not be manipulated
'[DEPRECATED] use require 'concurrent' instead of require 'concurrent_ruby'
Logstash startup completed
Logstash shutdown completed

Login to Kibana and add focustrpf Indexed data.
I can view the focustier.raw in Discover Page,But it has no value. The value i notice is "-"

Please advice..

6

And nothing comes up for this "focustier.raw" field in the Visual Page as well.

7

KB doesn't display the .raw fields there, try building a visualisation with it instead.

8

No luck in visualisation

9

Are you looking at the right time range?