Mapping text field with keyword not aggregatable

[pjanzen (Paul Janzen)]

Hi,

I create a mapping like this

    "login": {
      "type": "text",
      "fields": {
       "keyword": {
         "type": "keyword",
         "ignore_above" : 256
       }
     }
    },

(here is the full mapping)

If I follow the docs from here https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html
I should end up with a aggregatable field but it doesnt.. I have refreshed my fields in kibana but helaas that did not help.

I am running the lastest version of ELK 5.0.1.

I hope someone can help.

Thanks.
Paul.

[nik9000 (Nik Everett)]

You ought to have a field called login.keyword that is aggregatable. At least, in Elasticsearch you should be able to run aggregations on that field.

[pjanzen (Paul Janzen)]

Agreed, but if I have that field in elasticsearch kibana should see it as aggregatable I would expect.
It creates such a field in my dynamic mapping and those are perfectly aggregatable.

It could be that it is not a ES problem but a kibana problem, who knows....

Al other ideas are welcome...

Paul.

[Rudolf_Reddy_Macejka]

Hello,

i have similar problem.

if i want to aggregate by a .keyword field in main _source tree, all is working fine.
But if I have .keyword field in deeper sructure there I am not able to aggregate thta. Still getting empty result:

...
"queues": { "terms": { "field": "otherAttributes.queName.keyword" } }
...

Any idea why it is not able to aggregate the hierarchy?

Thank you!
Reddy

[nik9000 (Nik Everett)]

Nope! It ought to work. Could you try to reproduce the issue with curl? That helps remove lots of variables from things like this.

Also, you might want to start a new topic for it.