Hello,
This is my first time using elk 5.5 for gathering tweets from twitter, everything is ok and works fine.
In order to handle my application, I need to make the filed text (tweets ) as an aggregatable field, i tried to add raw field to text but nothing happened.
"properties": {
"text": {
"type" : "keyword","index": "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
},
This is the json template that I'm using
Blockquote
{
"template": "twitter",
"order": 1,
"settings": {
"number_of_shards": 3
},
"mappings": {
"tweet": {
"_all": {
"enabled": true
},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "text",
"mapping" : {
"type" : "text", "index" : "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
}
}
}, {
"text_fields" : {
"match" : "*",
"match_mapping_type" : "text",
"mapping" : {
"type" : "text", "index" : "not_analyzed", "omit_norms" : true,
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties": {
"text": {
"type" : "keyword","index": "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
},
"created_at": {
"index": "not_analyzed",
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z yyyy",
"locale": "US"
},
"user": {
"properties": {
"created_at": {
"index": "not_analyzed",
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z yyyy",
"locale": "US"
},
"screen_name": {
"index": "not_analyzed",
"type": "text"
},
"type": {
"type": "text"
}
}
},
"coordinates": {
"properties": {
"coordinates": {
"type": "geo_point"
},
"type": {
"type": "text"
}
}
}
}
}
}
}
waiting for your help,
Thank you