i have a field named "msg" in my index that holds an error message string.
when trying to count the top N errors i set the field to msg.raw yet i
still see that the terms are all the words comprising the strings rather
than the whole string as i would expect.
(i did not set this field to be "not_analyzed and if i understand correctly
logstash does that and puts it under the "raw" tag...)
this is my input, configuration and output
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to email@example.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b7d9b1bd-7cbc-4fc9-820c-a88eb6c56078%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.