Making text field aggregatable in kibana using elasticsearch

Elastic Stack Elasticsearch
1

Hello,

This is my first time using elk 5.5 for gathering tweets from twitter, everything is ok and works fine.
In order to handle my application, I need to make the filed text (tweets ) as an aggregatable field, i tried to add raw field to text but nothing happened.

"properties": {
"text": {
"type" : "keyword","index": "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
},

This is the json template that I'm using

Blockquote
{
"template": "twitter",
"order": 1,
"settings": {
"number_of_shards": 3
},
"mappings": {
"tweet": {
"_all": {
"enabled": true
},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "text",
"mapping" : {
"type" : "text", "index" : "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
}
}
}, {
"text_fields" : {
"match" : "*",
"match_mapping_type" : "text",
"mapping" : {
"type" : "text", "index" : "not_analyzed", "omit_norms" : true,
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties": {
"text": {
"type" : "keyword","index": "not_analyzed",
"fields" : {
"raw" : {"type": "text", "index" : "not_analyzed"}
}
},
"created_at": {
"index": "not_analyzed",
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z yyyy",
"locale": "US"
},
"user": {
"properties": {
"created_at": {
"index": "not_analyzed",
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z yyyy",
"locale": "US"
},
"screen_name": {
"index": "not_analyzed",
"type": "text"
},
"type": {
"type": "text"
}
}
},
"coordinates": {
"properties": {
"coordinates": {
"type": "geo_point"
},
"type": {
"type": "text"
}
}
}
}
}
}
}

waiting for your help,
Thank you

2

Use type "keyword" and drop the "index not analyzed" part on your "raw" fields.
However, I'd question the logic behind wanting to do this as this will introduce many largish fields into your index.
What business problem are you trying to solve here?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.