# Mapper-Size Query **URL:** \ **Category:** Kibana\ **Created:** [June 28, 2016, 10:40am UTC](https://discuss.elastic.co/t/mapper-size-query/54147 "2016-06-28T10:40:25Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [June 28, 2016, 10:40am UTC](https://discuss.elastic.co/t/mapper-size-query/54147/1 "2016-06-28T10:40:25Z")
Hi, Could someone please comment on the discussion in this thread: > [@Mapper-size plugin query](https://discuss.elastic.co/t/mapper-size-plugin-query/54010): > > Hi, I have started using the mapper-size plugin with one of our elasticsearch 2.2.0 clusters. In kibana I'm seeing that this field has a type of unknown and is unindexed. I've tried updating the mapping to: "\_size": { "enabled": true, "type": "integer", "index": "not\_analyzed" }, ...which throws an error: "Mapping definition for [\_size] has unsupported parameters: [index : not\_analyzed]" Removing the "index" parameter deals with that but still this field is not searchable. The plugin d… Regards, David ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 28, 2016, 2:58pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/2 "2016-06-28T14:58:14Z")
Hi David, I've read through your post in #elasticsearch and have been trying to reproduce your scenario. Unfortunately I'm not having much success. Here's what I'm observing; maybe you can tell me what you are observing that's different: I installed the mapper-size plugin in Elasticsearch 2.2.0 and creating an index with the following mapping: ``` PUT foo { "mappings": { "bar": { "_size": { "enabled": true } } } } ``` Then I indexed a couple of documents into it, of varying sizes. When I create an index pattern for this index in Kibana, I do **not** see the `_size` field in the list displayed by Kibana: ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1461d0d7036a18902271388906b60b0f2103e6f1.png) Given that, I cannot use the `_size` field in any visualizations for performing aggregations on it. ---
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [June 29, 2016, 2:37pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/3 "2016-06-29T14:37:40Z")
Hi, Silly question but did you restart your elasticsearch to enable the plugin? Regards, David ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 29, 2016, 3:06pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/4 "2016-06-29T15:06:12Z")
Hi! Yes, I stopped Elasticsearch to install the plugin, installed the plugin, and then started up Elasticsearch again. ---
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [June 30, 2016, 7:14am UTC](https://discuss.elastic.co/t/mapper-size-query/54147/5 "2016-06-30T07:14:38Z")
When you get the mapping for the index you have "\_size" defined for what do you see? ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 30, 2016, 1:00pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/6 "2016-06-30T13:00:58Z")
The initial mapping, right after I create the index (as described in [Mapper-Size Query](https://discuss.elastic.co/t/mapper-size-query/54147/2)) looks like this: ``` $ curl 'http://localhost:9200/foo/_mapping?pretty' { "foo" : { "mappings" : { "bar" : { "_size" : { "enabled" : true } } } } } ``` After I indexed a couple of documents with field `p1` containing strings of varying sizes, my mapping looks like this: ``` $ curl 'http://localhost:9200/foo/_mapping?pretty' { "foo" : { "mappings" : { "bar" : { "_size" : { "enabled" : true }, "properties" : { "p1" : { "type" : "string" } } } } } } ``` ---
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [June 30, 2016, 2:21pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/7 "2016-06-30T14:21:45Z")
Have you updated the metafields definition in the advanced settings? ---
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [July 5, 2016, 11:04am UTC](https://discuss.elastic.co/t/mapper-size-query/54147/8 "2016-07-05T11:04:00Z")
Is this no longer being looked at? ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [July 14, 2016, 2:09pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/9 "2016-07-14T14:09:11Z")
Hi David, Apologies! I rely on getting email notifications whenever there are updates to a topic but that seems to have broken somehow because I never got notifications about your latest two posts. Anyway, I updated `metaFields` in Advanced Settings and added `_size` to that list. After that, if I refresh the index pattern definition for my index, I see `_size` in the list but with type as unknown: ![](https://us1.discourse-cdn.com/elastic/original/2X/5/543e2ba5d11688186c6ace98b5608443bb79a84d.png) As Kibana doesn't know the type of this field, it doesn't know which aggregations can use it. Therefore it doesn't show it in the visualization editor. Next I'm looking into _why_ Kibana is unable to figure out the type of this field. I'm guessing this information is not being returned from Elasticsearch but let me confirm that. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [July 18, 2016, 6:06pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/10 "2016-07-18T18:06:39Z")
Hi @dawiro, I finally got some time to dig into the Kibana code and figure out what's going on here. The summary is that Elasticsearch does not report the datatype of the `_size` field to Kibana so Kibana sets it to "unknown". Without knowing a field's type Kibana cannot determine which aggregations can use this field so Kibana makes the field unavailable in the visualization editor. Read on for more specific details on what's going on in Kibana: In order to generate the list of fields for an index pattern, Kibana must request the mappings for all fields from Elasticsearch. To do this it makes a REST API call to Elasticsearch like this: `GET {host}:{port}/{index-pattern}/_mapping/field/*`. This call returns a response that looks something like this: ``` { "{index-name}" : { "mappings" : { "{type}" : { ... mappings for some fields ..., "_size" : { "full_name" : "_size", "mapping" : { "_size" : { "enabled" : true } } }, ... mappings for remaining fields ... } } } } ``` In this response Kibana looks for a `type` property in each field's mapping. As you can see in the example response above the `_size` field's mapping does not contain a `type` property. Since Kibana does not find the `type` property it sets the type of the field to "unknown". If you'd like, please [create an enhancement request issue in the Elasticsearch Github repository](https://github.com/elastic/elasticsearch/issues/new) asking the mapper size plugin to report its type in the API response above. ---
**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Post date:** [July 19, 2016, 1:13pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/11 "2016-07-19T13:13:55Z")
Thanks! it's good that you've been able to reproduce my findings... ---
**Author:** ![Marcel\_Matus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_matus/32/140970_2.png) [@Marcel\_Matus](https://discuss.elastic.co/u/Marcel_Matus)\ **Post date:** [August 10, 2016, 9:35pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/12 "2016-08-10T21:35:04Z")
Hi There, this is very useful information to be visualized also for me. I was investigating and realized one work-around for this - you can create Scripted field and then use it: - create scripted field, name it whatever you want (ie. \_doc\_size) - make this numeric field - script: doc['\_size'].value that's that! Hopefully this will help someone. Marcel ---
**Author:** ![cbismuth](https://avatars.discourse-cdn.com/v4/letter/c/9e8a1a/32.png) [@cbismuth](https://discuss.elastic.co/u/cbismuth)\ **Post date:** [June 1, 2017, 12:01pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/13 "2017-06-01T12:01:55Z")
It helped a lot, thank you Marcel. ![](https://us1.discourse-cdn.com/elastic/original/3X/1/0/108eb4ba3e827feb4ecbf8b76e74f017c8ebb952.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:31pm UTC](https://discuss.elastic.co/t/mapper-size-query/54147/14 "2017-07-06T13:31:38Z")