Nested Type in Kibana

Elastic Stack Elasticsearch
1

Hi

I'm using Kibana 5.6.13 and I'm having nested type as below

{
"test": {
"mappings": {
"sessions": {
"properties": {

      "appdata": {
        "type": "nested",
        "properties": {
          "accessType": {
            "type": "text"
          },
          "appname": {
            "type": "keyword"
          },
          "eventtime": {
            "type": "date"
          }
        }
      },
      "uptime": {
        "type": "double"
      },
      "username": {
        "type": "keyword"
      },
      "usersCount": {
        "type": "long"
      }
    }
  }
}

}
}

Data in index as below

"_source": {
"sessionid": "3FEBB8F16698434895DC9B2D6E406ED0",
....
....
.....
"appdata": [
{
"accessType": "ag_app",
"appname": "first",
"eventtime": "2019-02-26T16:14:50.275+0530"
}
]
}
},

I want show this appdata.appname in my Vertical Bar chart. When I selected Terms->Field with appdata.appname, Kibana doesnt show any records. How to achieve this???

2

Hi @RAM_NATHAN,

Unfortunately Kibana doesn't support aggregation on nested fields yet. You can track the progress in #1084.

Also there is a 3rd-party KibanaNestedSupportPlugin that adds nested field supports for the Kibana. You can check it out.

Best,
Oleg

3

Thanks for the reply. Instead of separate plugin, Will it possible to achieve the same with "Include_In_Parent"?? I have added the same flag as below

"appdata": {
"type": "nested",
"include_in_parent": true,
"properties": {
"accessType": {
"type": "text"
},
"appname": {
"type": "keyword"
},
"eventtime": {
"type": "date"
}
}

But still Kibana doesnt show any data. Won't this help??

4

Can you please provide a reply???

5

Sorry. Please ignore my previous comment. I'm able to achieve with "Include_in_parent". I understand that field will be deprecated in future release.
Other than that does it have any performance issue?? Shouldn't be used for any reason other than deprecation??

6

Can someone please reply back??

7

I believe you can use copy_to instead?

8

Thanks for the reply.. Wont that get deprecated??? . Is it advisable to use copy_to for nested type in kibana???

9

I believe so.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.