Raw field not showed in kibana for term aggregation

(michele crudele) #1

I have indexed a pathname field as follows:

        "file_name" : {
          "type": "string",
          "analyzer": "pathname_analyzer",
          "search_analyzer": "keyword",
          "fields": {
            "raw": {
              "index": "not_analyzed",
              "type": "string"

While I'm able to search file_name.raw: "exact pathname" in Kibana discover, I cannot build a term aggregation visualization because the field_name.raw is not showed. Only file_name is, and I cannot create a term aggr because the field is analyzed.
Am I doing something wrong? Thanks in advance.

(Shelby Sturgis) #2

michele_crudele, you need to change your mapping to that of a multi field. See here for an example.

(michele crudele) #3

multi_field is deprecated... see here https://www.elastic.co/guide/en/elasticsearch/reference/current/_multi_fields.html

I did that before and when I retrieved the mapping I realized the system replaced multi_field with a different definition

(michele crudele) #4

My apologies. I forgot to refresh the fields list when I re-created the index with the new "fields" parameter. After that, kibana started recognizing the new file_name.raw.

(system) #5