No Results Found as soon as Line Chart is Split

Elastic Stack Kibana
1

ES 5.1.1 server and Kibana (Windows 7 64bit).

Not sure if this is a Kibana or an Elastic Search issue or my stupidity but I'm trying to make a split line chart and following instructions like this.

As soon as I try to split my line by the field type I get no results.

2

I whole heartedly understand how confusing it can be to deal with the difference between fields like type and type.keyword. We would love for Kibana to handle this more intuitively but the feature is pretty hard to simplify because of it's power and flexibility.

Some potential reasons: for this behavior

  • Does the response from the spy panel show any data? If not then the documents in that time-range must don't have any values for type.keyword
  • Did type.keyword Exist when you indexed the docs? If not you'll need to reindex.
  • How was the type.keyword field created? What does you mapping look like?
3

I do indeed have a field called "type". Not sure what "type.keyword" is. What does ".keyword" mean??

4

I got type.keyword from the aggregation example in the github issue.

.keyword fields are not-analyzed which makes them well suited for aggregations. Logstash copies all string fields into these .keyword fields by default and disables running aggregations on the non-.keyword versions.

5

Yeah but when I created the mapping I made a field called "type" of type "keyword". Possibly I originally just loaded some data without a mapping -> resulting in "type" and then later made an explicit mapping called "type" of type "keyword" which resulted in 2 fields?

6

Hmm... that doesn't sound right.

7

Can you send a screenshot of the visualize app when it's showing this behavior?

8

Well, I deleted my index, recreated the mapping explicitly and loaded my data. I am now able to split the bar/line charts. I think my analysis was correct and Kibana was getting confused between type and type.keyword and thus it's kind of a bug somewhere.

Unfortunately I can't now show you my original configuration but it's as I described: certain fields were duplicated with ".keyword".

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.