Query analyzed field

Elastic Stack Kibana
1

Hi Team,
I am trying to build a tabular dashboard and need some help for fields that are analyzed ones. is there any way we can set "not_analyzed" in kibana, or updating index is the only option?

e.g.: if value region="us-east-1" and in tabular dashboard there are three rows like below:
us
east
1

please let me know if need more details.

Regards,

2

You can have Elasticsearch create non-analyzed version of fields for you automatically, but existing documents would be missing the non-analyzed version if you didn't reindex. There's no way around it, unfortunately.

Check out Dynamic Templates, they allow you to, for example, store any string type field duplicated as a .raw version as well, and which is not analyzed. Something like this should do it:

mappings: {
  'my-index*': {
    dynamic_templates: {
      string_fields : {
        mapping : {
          index : "analyzed",
          omit_norms : true,
          type : "string",
          fields : {
            raw : {
              index : "not_analyzed",
              ignore_above : 256,
              doc_values : true,
              type : "string"
            }
          }
        },
        match : "*",
        match_mapping_type : "string"
      }
    }
  }
}
3

Thanks Joe, i will give it a try.