# No Results Found as soon as Line Chart is Split

**URL:** <https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808>\
**Category:** Kibana\
**Created:** [December 22, 2016, 2:24pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808 "2016-12-22T14:24:49Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [December 22, 2016, 2:24pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/1 "2016-12-22T14:24:49Z")

</div>

ES 5.1.1 server and Kibana (Windows 7 64bit).

Not sure if this is a Kibana or an Elastic Search issue or my stupidity but I'm trying to make a split line chart and following instructions like this.

As soon as I try to split my line by the field type I get no results.

> <https://github.com/elastic/elasticsearch/issues/22312>

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [December 22, 2016, 5:02pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/2 "2016-12-22T17:02:23Z")

</div>

I whole heartedly understand how confusing it can be to deal with the difference between fields like `type` and `type.keyword`. We would love for Kibana to handle this more intuitively but the feature is pretty hard to simplify because of it's power and flexibility.

Some potential reasons: for this behavior

- Does the response from the spy panel show any data? If not then the documents in that time-range must don't have any values for `type.keyword`
- Did `type.keyword` Exist when you indexed the docs? If not you'll need to reindex.
- How was the type.keyword field created? What does you mapping look like?

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [December 22, 2016, 7:39pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/3 "2016-12-22T19:39:51Z")

</div>

I do indeed have a field called "type". Not sure what "type.keyword" is. What does ".keyword" mean??

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [December 22, 2016, 7:51pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/4 "2016-12-22T19:51:19Z")

</div>

I got `type.keyword` from the aggregation example in the github issue.

`.keyword` fields are not-analyzed which makes them well suited for aggregations. Logstash copies all string fields into these `.keyword` fields by default and disables running aggregations on the non-`.keyword` versions.

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [December 22, 2016, 9:07pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/5 "2016-12-22T21:07:31Z")

</div>

Yeah but when I created the mapping I made a field called "type" of type "keyword". Possibly I originally just loaded some data without a mapping -\> resulting in "type" and then later made an explicit mapping called "type" of type "keyword" which resulted in 2 fields?

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [December 22, 2016, 9:19pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/6 "2016-12-22T21:19:19Z")

</div>

Hmm... that doesn't sound right.

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [December 22, 2016, 9:30pm UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/7 "2016-12-22T21:30:27Z")

</div>

Can you send a screenshot of the visualize app when it's showing this behavior?

---

<div class="post-metadata">

**Author:** ![Marc\_Cawood](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Marc\_Cawood](https://discuss.elastic.co/u/Marc_Cawood)\
**Post date:** [December 23, 2016, 7:21am UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/8 "2016-12-23T07:21:19Z")

</div>

Well, I deleted my index, recreated the mapping explicitly and loaded my data. I am now able to split the bar/line charts. I _think_ my analysis was correct and Kibana was getting confused between type and type.keyword and thus it's kind of a bug somewhere.

Unfortunately I can't now show you my original configuration but it's as I described: certain fields were duplicated with ".keyword".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2017, 7:22am UTC](https://discuss.elastic.co/t/no-results-found-as-soon-as-line-chart-is-split/69808/9 "2017-01-20T07:22:03Z")

</div>

Closed on January 20, 2017, 7:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
