Lookup value in terms facet


(Simon Woodhead) #1

hi folks,

I'm pretty new to elasticsearch but loving it and seeing loads of potential
use cases for it. I have some dummy data going into it and some great
Kibana visualisations of it.

However, one issue I'm struggling with in output (and thus Kibana charts)
is lookup values and would appreciate some pointers.

We have data like

{"key":"123","value":"some human readable text that is usually but not 100%
consistent"}

I can do terms facets on the key and they work as expected. I can't do them
on the 'value' for two reasons:

  • the results are split by space (but I understand this could be resolved)
  • the value may change over time whereas the key never will

Is there a lightweight way to facet on the key but output one of the values
(most recent if there's control)?

If I've confused all of that, all I want is the human readable part as
legend on charts rather than the key :slight_smile:

Thanks in advance for any help,
Simon

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Ivan Brusic) #2

Look at the terms stats facet which would allow you to change with field is
used for the value:

http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets-terms-stats-facet.html

You can ignore the other statistics if you just want the count. For best
results, the value should be on a non-analyzed field.

--
Ivan

On Sun, Dec 8, 2013 at 5:19 AM, Simon W woodheads@gmail.com wrote:

hi folks,

I'm pretty new to elasticsearch but loving it and seeing loads of
potential use cases for it. I have some dummy data going into it and some
great Kibana visualisations of it.

However, one issue I'm struggling with in output (and thus Kibana charts)
is lookup values and would appreciate some pointers.

We have data like

{"key":"123","value":"some human readable text that is usually but not
100% consistent"}

I can do terms facets on the key and they work as expected. I can't do
them on the 'value' for two reasons:

  • the results are split by space (but I understand this could be resolved)
  • the value may change over time whereas the key never will

Is there a lightweight way to facet on the key but output one of the
values (most recent if there's control)?

If I've confused all of that, all I want is the human readable part as
legend on charts rather than the key :slight_smile:

Thanks in advance for any help,
Simon

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com
.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Simon Woodhead) #3

Hi Ivan

Thanks for that, yep, that looks like it solves the problem. Can’t see it anywhere in Kibana but it helps for direct queries.

cheers
Simon

On 9 Dec 2013, at 05:30, Ivan Brusic ivan@brusic.com wrote:

Look at the terms stats facet which would allow you to change with field is used for the value:

http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets-terms-stats-facet.html

You can ignore the other statistics if you just want the count. For best results, the value should be on a non-analyzed field.

--
Ivan

On Sun, Dec 8, 2013 at 5:19 AM, Simon W woodheads@gmail.com wrote:
hi folks,

I'm pretty new to elasticsearch but loving it and seeing loads of potential use cases for it. I have some dummy data going into it and some great Kibana visualisations of it.

However, one issue I'm struggling with in output (and thus Kibana charts) is lookup values and would appreciate some pointers.

We have data like

{"key":"123","value":"some human readable text that is usually but not 100% consistent"}

I can do terms facets on the key and they work as expected. I can't do them on the 'value' for two reasons:

  • the results are split by space (but I understand this could be resolved)
  • the value may change over time whereas the key never will

Is there a lightweight way to facet on the key but output one of the values (most recent if there's control)?

If I've confused all of that, all I want is the human readable part as legend on charts rather than the key :slight_smile:

Thanks in advance for any help,
Simon

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elasticsearch/moMI20NqG1w/unsubscribe.
To unsubscribe from this group and all its topics, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/01D9A55E-1370-426D-9F68-9445781433A4%40gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #4